UNIVERSITY OF SOUTHERN CALIFORNIA
bd_8c72490c6576b58e · schema v1 · pii pii-v1
Full breach record for UNIVERSITY OF SOUTHERN CALIFORNIA →University of California disclosed a data breach involving its Accellion File Transfer Appliance (FTA). The incident occurred on December 24, 2020, when attackers exploited a vulnerability in the application. Unauthorized access resulted in the exfiltration of personal information, including names, SSNs, driver's license info, passport info, financial account numbers, and health/benefit data. The breach was discovered on March 29, 2021, when data was found posted on the Internet. UC notified affected individuals, offered credit monitoring via Experian, and patched the vulnerability. The investigation is ongoing with FBI cooperation.
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-540841
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 13, 2021
- Raw hash
- 99c89d0ae8d7abec0b4bab3e9bd57b2049222bd47e0b79239dde314782cc48b5
Reporting entity
- Name
- UNIVERSITY OF SOUTHERN CALIFORNIAnorm: university of southern california
Victim entity
- Name
- UNIVERSITY OF SOUTHERN CALIFORNIAnorm: university of southern california
Incident
- Discovered
- Mar 29, 2021
- Materiality determined
- —
- Notification sent
- Apr 1, 2021
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- cooperating with the FBI
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(45 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 3d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Mar 29, 2021→ Notified: Apr 1, 20213d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.