San José State University

On December 10, 2018, San Jose State University (SJSU) detected unauthorized access to a server operated by its auxiliary, SJSU Associated Students. The attacker accessed names, email addresses, usernames, and passwords. No SSNs, financial, or medical data were involved. SJSU blocked access, disabled credentials, and notified affected individuals on December 26, 2018. Remediation included migrating servers to SJSU infrastructure and conducting security assessments.

San Diego State University discovered a misconfigured database managed by the Pre-College Institute containing names, SSNs, dates of birth, and addresses of pre-college students. The database was accessible to any computer on the SDSU wired network with FileMaker software. No evidence of malicious access was found. The database was reconfigured to restrict access to authorized employees only.

San Francisco State University notified individuals that its College of Extended Learning server was compromised on March 25, 2013. The university became aware of the incident on June 11, 2013, when notified by federal law enforcement. The unauthorized access potentially exposed names and Social Security numbers. The university offered two years of identity protection services through AllClear ID.