The recent cybersecurity incident at the University of California led to the compromise of confidential information, as confirmed by university executives this week. This unauthorized access was reportedly realized through abuse of a critical vulnerability on the Accellion FTA server, an online file sharing platform.
On Monday, the University published a more detailed report on the incident, confirming that threat actors managed to compromise information from former and current administrative employees, pensioners, beneficiaries, students, professors and others who participated in some programs open to the general public.
Among the information compromised are confidential details such as
- Full names
- Dates of birth
- Addresses
- Phone numbers
- Social security numbers
- Financial records
- Medical history
The report also mentions that people who applied for courses from the 2021-2022 academic periods may also have been affected by this incident.
As a result of this incident, the University’s executives decided to stop using Accellion FTA, so right now they are migrating their resources to a more secure solution: “We have de- unsubscribed the FTA system from our networks and are in the process of transitioning to a new file transfer system with enhanced security controls, implementing additional system monitoring across our network.” However, the security flaw in Accellion abused by the hackers responsible for this attack was also corrected.
In addition, the University will offer all affected individuals one year of free monitoring service to prevent any attempted attack related to this incident: “Within the next 45 or 60 days we will notify all users about the incident, plus we will establish mechanisms to address the data breach,” concludes the University of California.
So far an exact number of affected users have not been confirmed, although the incident will be investigated by the Federal Bureau of Investigation (FBI) and private security firms to hear all the details of the matter.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
