UC Regents Settles $5.8 Million Class Action Over 2020-2021 Data Breach The University of California (UC) Regents has finalized a $5.8 million settlement in Erazo v. The Regents of the University of California, resolving a class action lawsuit stemming from a 2020-2021 data breach. The incident, which exposed sensitive information of over 350,000 UC students and employees, occurred between mid-December 2020 and January 2021 due to a compromised file transfer application licensed by Accellion, Inc. The breach allegedly exposed data from the 2020 UC Undergraduate Experience Survey and medical records. While the UC Regents denied wrongdoing as part of the settlement, they agreed to distribute payments to affected individuals, cover litigation costs, and implement enhanced cybersecurity measures for at least two years. These measures include retiring the vulnerable Accellion FTA system, migrating to a secure file transfer product, increasing system monitoring, and providing security training for relevant employees. Payments to the 353,265-member settlement class have begun, with eligible claimants notified via email. The settlement fund will also cover administrative expenses and attorneys' fees. The case was settled on May 29, 2025.

Accellion Data Breach Litigation: Court Rejects Plaintiffs’ Bid to Expand Class Damages A federal court has denied plaintiffs’ attempt to modify a class certification order in litigation stemming from a 2020–2021 data breach involving Accellion Inc.’s file-transfer software. Judge Edward J. Davila of the U.S. District Court for the Northern District of California ruled that the plaintiffs failed to present new evidence or legal arguments justifying reconsideration of the original decision, which limited class damages to nominal amounts. The case centers on cyberattacks targeting Accellion’s legacy File Transfer Appliance (FTA) software, which exposed sensitive data from numerous organizations. Despite allegations of harm, the court upheld its prior certification of subclasses for nominal damages only, striking the plaintiffs’ renewed motion. The ruling underscores the challenges plaintiffs face in securing broader compensation in data breach litigation, particularly when courts determine that demonstrated harm is insufficient to warrant expanded damages. The decision leaves the original class structure intact, with no further modifications granted.