UPDATE (April 8, 2021): More answers to questions about the Accellion data breach and how to protect yourself

 

Related Links

What happened — what is this about?

Like several hundred other institutions throughout the country, including universities, government institutions and private companies, UC has been using a vendor service called Accellion File Transfer Appliance (FTA) to transfer information. Accellion was the target of an international cyber attack where the perpetrators exploited a vulnerability in Accellion’s program and attacked roughly 100 organizations. The attackers are now attempting to get money from organizations and individuals.

What kind of personal information was stolen?

At this time, we believe the stolen information includes but is not limited to names, addresses, telephone numbers, birth dates, Social Security numbers and bank account information for a range of UC populations, including employees and their dependents and beneficiaries, retirees and their beneficiaries, students and their families, and potentially other individuals with connections to UC.

How do I know if my information was involved?

We are investigating the incident and working to identify affected individuals. We will notify affected people and provide information regarding additional steps they can take to protect themselves. Meanwhile, UC recommends that all members of the UC community take immediate action to protect themselves, including signing up for UC’s free credit monitoring and identity theft protection through Experian.

What is UC doing to protect my data?

UC is conducting a thorough review of the security controls for centralized systems handling sensitive data, and we will be implementing additional security measures to prevent similar incidents in the future. We are also working with local and federal law enforcement and third-party vendors to investigate this incident, to assess the information that has been compromised, to enforce the law, and to limit the release of stolen information.

Are my family members’ information impacted?

Family members who are listed as dependents or beneficiaries on employee or retiree accounts, or who are listed on student paperwork, may be affected. Family members in these groups should take immediate action to protect themselves, including signing up for UC’s free credit monitoring and identity theft protection through Experian.

Are my medical benefits impacted?

Your benefits are not impacted, but your personal information may be at risk. You are strongly encouraged to take immediate action to protect yourself, including signing up for UC’s free credit monitoring and identity theft protection through Experian.

I am a UC retiree — is my pension impacted?

Your pension is not impacted, but your personal information may be at risk. You are strongly encouraged to take immediate action to protect yourself, including signing up for UC’s free credit monitoring and identity theft protection through Experian.

How long will free credit monitoring and identity theft protection last?

The free credit monitoring and identity theft protection UC is offering its community members is good for one year.

How do I protect myself?

All members of the UC community are encouraged to sign up for free credit monitoring and identity theft protection through Experian. Additionally, here are five rules for protecting your information. You may also take additional identity theft measures described at https://www.identitytheft.gov/databreach.

How can I be sure the Experian site is secure and it’s safe to provide Experian my personal information?

Information about Experian’s security measures and tools is available on the Experian website.

Why does the Experian website require my Social Security number and other personal information?

The Experian service also provides Internet-based identity monitoring in order to notify you if any of your personal information, such as your Social Security number, is found as being bought or sold online.

Is this attack real or another phishing scam?

As UC announced previously, this is a real and serious attack on Accellion that has impacted UC. All members of the UC community are strongly encouraged to take immediate action to protect themselves, including signing up for UC’s free credit monitoring and identity theft protection through Experian.

What should I do if I get an email or phone call asking me for money?

These types of messages should be immediately forwarded to your local information security office.

Is it safe to click on the links in these FAQs or the UC emails I receive?

Yes. If you have any questions whether a UC email, document or web page regarding this incident is legitimate, please contact your local information security office.

What should I do if I have questions?

Questions about this incident may be sent to communications@ucop.edu. We will address as many questions as possible on this website.