HackingEducationEducationVulnerability ExploitData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PIIMediumContained

UNIVERSITY OF SOUTHERN CALIFORNIA

bd_8c72490c6576b58e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 29, 2021

Filed

May 13, 2021

To disclose

6 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for UNIVERSITY OF SOUTHERN CALIFORNIA →3 incidents on file

University of California experienced a security event on December 24, 2020, where perpetrators exploited a vulnerability in its Accellion file transfer appliance. Unauthorized access to personal information including names, SSNs, financial data, and health information was confirmed. The University took the system offline, patched the vulnerability, and engaged forensic experts. Free credit monitoring was provided to affected community members.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 29, 2021 → Notified May 11, 202143d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 95 days

discovery → filing · 6 weeks / 45 days

Dec 24, 2020

Begins

Mar 29, 2021

Discovered

May 13, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: UNIVERSITY OF SOUTHERN CALIFORNIA
norm: university of southern california

Name: UNIVERSITY OF SOUTHERN CALIFORNIA
norm: university of southern california
Industry: Educationllm

Discovered: Mar 29, 2021
Breach occurred: Dec 24, 2020
Undetected for: 95 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 11, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PII
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Cooperating with the FBI
Initial access: exploit_public_facing

During the incident: Took the system offline
Patched the Accellion vulnerability
Cooperating with the FBI
Working with external cybersecurity experts to investigate this matter
Notified community members via email
Hosted interactive workshops at several campuses
Posted online information about the event
Arranged for free credit monitoring and identity theft protection services through Experian IdentityWorks
Established a dedicated call center to answer questions
Changes made: Transitioning to a more secure solution
Deploying additional system monitoring broadly throughout our network
Conducting a security health check of certain systems
Enhancing security controls, processes and procedures
Reviewing and updating our security policies, procedures and controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: CA 60-day OK · 43d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 29, 2021
→ Notified: May 11, 2021
43d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 29, 2021 → Notified: May 11, 2021	43d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-540841
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 13, 2021
Raw hash: 99c89d0ae8d7abec0b4bab3e9bd57b2049222bd47e0b79239dde314782cc48b5

Reporting entityUNIVERSITY OF SOUTHERN CALIFORNIA

Victim entityUNIVERSITY OF SOUTHERN CALIFORNIA

Incidentdiscovered Mar 29, 2021

Stated responseTook the system offline

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov