USD
Company Details
Linkedin ID:
ucsandiego
Website:
Employees number:
19,749
Number of followers:
408,357
NAICS:
6113
Industry Type:
Homepage:
ucsd.edu
IP Addresses:
495
Company ID:
UC _1452773
Scan Status:
Completed
UC San Diego Company CyberSecurity Posture
ucsd.edu
Recognized as one of the top 15 research universities worldwide, our culture of collaboration sparks discoveries that advance society and drive economic impact. Everything we do is dedicated to ensuring our students have the opportunity to become changemakers, equipped with the multidisciplinary tools needed to accelerate answers to our world’s most pressing issues.
UC San Diego A.I CyberSecurity Scoring
USD Risk Score (AI oriented)Between 800 and 849
USD
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
USD Global Score (TPRM)XXXX
USD
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
USD Company CyberSecurity News & History
Past Incidents
19
Attack Types
3
UC Irvine Medical Center
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: In June 2015, the California Office of the Attorney General disclosed a data breach at the **University of California Irvine Medical Center**, where an employee improperly accessed patient records over an extended period—from **June 2011 to March 2015**. The unauthorized access exposed **personal health information (PHI)** of an **unknown number of patients**, though investigations found **no evidence of sensitive data being stolen or misused**. The breach stemmed from internal misconduct, highlighting vulnerabilities in **employee access controls and monitoring protocols**. While the exposed data included patient details, the lack of confirmed theft or external exploitation mitigated some risks. However, the prolonged duration of the breach (nearly **four years**) raised concerns about **compliance with healthcare privacy regulations (e.g., HIPAA)** and the potential for **reputational damage** due to the mishandling of confidential medical records. The incident underscored the need for stricter **audit trails, access restrictions, and employee training** to prevent similar internal breaches in healthcare institutions.
University of California, Irvine
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The University of California, Irvine experienced a data breach reported on **May 14, 2014**, involving unauthorized access to its systems. The breach occurred due to computers being infected with a **keystroke logger** between **February 14 and March 27, 2014**, which potentially compromised **personal and unencrypted medical data** of individuals. The exact number of affected individuals remains **unknown**, raising concerns about the exposure of sensitive health information. The attack method suggests a targeted intrusion aimed at harvesting confidential data, likely through malicious software designed to capture keystrokes—including login credentials, medical records, or other personally identifiable information (PII). The breach underscores vulnerabilities in the university’s cybersecurity defenses, particularly in protecting high-risk data like medical records, which are subject to strict regulatory protections (e.g., HIPAA). The incident highlights the risks of **unauthorized data access** in academic institutions handling sensitive information, with potential long-term repercussions for trust, legal compliance, and individual privacy.
UCI Health
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: An employee of UC Irvine Medical Center unethically viewed thousands of patient records over a four-year period. The incident compromised the personal health information including names, dates of birth, gender, medical record numbers, height, weight, medical center account numbers, allergy information, home address, medical documentation, diagnoses, test orders and results, of 4,859 patients . The center investigated the incident with the help of external security experts and notifies the affected patients.
UCLA
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The five new MOVEit assaults victims revealed on the dark web leak site for the Clop ransomware organization include the industrial behemoths Siemens Energy, Schneider Electric, werum.com, UCLA (http://ucla.edu), Abbie (http://abbvie.com), and Abbie. Worldwide, vital national infrastructures use Industrial Control Systems (ICS) from Siemens Energy and Schneider Electric. Threat actors claim they were able to compromise 100 different firms utilizing the most recently revealed MOVEit Transfer vulnerability CVE-2023-34362. The US government offers rewards for information that leads to the arrest, indictment, or location of dangerous actors.
UCLA Health
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: UCLA Health experienced a data breach incident in September 2015 after one of its laptop got stolen. The stolen laptop contained the personal information of approximately 1,242 patient of the organization including names and medical record numbers. UCLA Health notified all affected patient and retraining those involved with the incident.
UCLA Health
Data Leak
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: UCLA health experienced a data breach incident that 94,000 patients personal information and health data to third parties. UCLA Health promptly disabled the use of the tools and launched an investigation. The compromised information includes patients’ URL/website addresses, provider names, specialty, ad campaign names, page views, IP addresses, third-party cookies, and hashed values of certain fields on the appointment request form, such as patient names, email addresses, mailing addresses, phone numbers, and genders. UCLA Health website and the UCLA Health mobile app were affected. The UCLA Health patient portal was not impacted.
University of California
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: The California Office of the Attorney General reported a data breach at the University of California on May 13, 2021. The breach occurred on December 24, 2020, when an unauthorized third party accessed files containing personal information of UC community members, including Social Security numbers and financial information. Approximately 100 organizations were similarly attacked, but the number of affected individuals specific to UC is unknown.
UC San Diego Health Hillcrest - Hillcrest Medical Center
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: The California Office of the Attorney General reported that UC San Diego Health experienced a data breach due to a phishing attack, which occurred between January 9 and January 22, 2024. The breach involved unauthorized access to employee email accounts, potentially exposing personal information such as names and Social Security numbers, affecting an unspecified number of individuals. The breach was reported on March 8, 2024.
UC San Diego Health
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: UC San Diego Health suffered from a data breach that exposed number of patients, employees and others connected to UC San Diego Health potentially. It was found that the breach occurred via unauthorized access to some employee email accounts, but it did not affect the continuity of care for their patients. A UCSD Health spokesperson said Tuesday that ransomware, software often used to extort money from an organization, was not involved. The compromised information includes full names, addresses, dates of birth, email addresses, fax numbers, claims information including dates and costs of care received, laboratory results, medical diagnoses and conditions, medical record numbers, prescription information, treatment information, Social Security numbers, government identification numbers, financial account numbers, student identification numbers, usernames and passwords. They notified people, and the letters each person receives precisely reflect the information that would have been impacted for that particular person.
UC San Diego Health
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: The California Office of the Attorney General reported that UC San Diego Health experienced a data breach involving unauthorized access to employee email accounts. The incident occurred between December 2, 2020, and April 8, 2021, affecting personal information including Social Security numbers and medical details. The breach was reported on September 9, 2021.
UC San Diego School of Medicine
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: The California Office of the Attorney General reported that UC San Diego School of Medicine experienced a data breach on August 3, 2016. The breach involved personal information including names and social security numbers of trainees. The incident was reported on September 22, 2016.
UC San Diego Health
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The California Office of the Attorney General reported a data breach at UC San Diego Health that occurred between November 20, 2017, and December 9, 2017, with notification issued on June 14, 2019. An unauthorized third party accessed a medical transcription platform, potentially compromising patient data such as names, dates of birth, and clinical information, but did not access Social Security numbers or financial account information. The number of individuals affected is currently unknown.
UC San Diego Health
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: UC San Diego Health suffered a data breach via its third-party vendor, Solv Health, between **September 13 and December 22, 2022**. The incident exposed sensitive personal information of individuals who used Solv Health’s scheduling websites. Compromised data may include **names, dates of birth, email addresses, and insurance details**, though the exact number of affected individuals remains undisclosed. The breach stems from a vulnerability or security lapse within Solv Health’s systems, indirectly impacting UC San Diego Health’s patients. While no financial or medical records appear to have been stolen, the exposure of personally identifiable information (PII) raises concerns over potential identity theft, phishing, or fraudulent activities targeting the victims. The breach underscores risks associated with third-party vendor dependencies in healthcare data management, where even non-direct attacks can erode trust and necessitate regulatory disclosures under laws like **HIPAA** or **CCPA**. UC San Diego Health likely faced reputational damage and operational disruptions in addressing the fallout, including notifications, credit monitoring offers, and system audits to prevent future incidents.
UC San Diego Health
Ransomware
Rankiteo Explanation
Attack that could injure or kill people
Description: UC San Diego Health experienced a ransomware attack threatening critical healthcare operations. As the medical industry increases reliance on technology, such attacks can have dire consequences on patient care and outcomes. The attack's costliness, with an average of $11 million according to IBM, poses risks to smaller healthcare systems' existence, potentially leading to their permanent closure. Patients in remote areas would be most affected due to the scarcity of nearby medical facilities. In response, federal funding has been allocated to develop better preventative and mitigative measures, focusing on cybersecurity in healthcare.
University of California San Francisco (UCSF)
Ransomware
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The University of California San Francisco suffered a significant ransomware attack at the hands of the NetWalker group, which resulted in the loss of access to critical data. In order to recover the encrypted files, UCSF was compelled to pay a substantial ransom of $1.14 million. This incident stressed the vulnerability of major institutions to sophisticated cyber threats, particularly during sensitive times such as the COVID-19 pandemic when reliance on digital infrastructure is at its peak. The attack not only financially impacted the university but also highlighted the potential risks to privacy and the continuation of essential services.
UCSF Medical Center
Breach
Rankiteo Explanation
Attack limited on finance or reputation
Description: The California Office of the Attorney General reported a data breach involving UCSF Medical Center on October 2, 2013. The breach occurred on September 9, 2013, due to the theft of an unencrypted laptop from a locked vehicle, potentially affecting health information of individuals, including names and medical record numbers.
University of California San Francisco
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: The California Office of the Attorney General reported a data breach involving the University of California San Francisco (UCSF) on November 21, 2013. The breach occurred on September 25, 2013, when an unencrypted personal laptop containing identifiable health information was stolen from a physician's locked vehicle. The stolen laptop contained sensitive health information, which could potentially compromise the privacy and security of the affected individuals.
UCSF Health
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The University of California, San Francisco (UCSF) experienced a data breach on **February 9, 2023**, disclosed on **April 26, 2023**, due to a **phishing attack** targeting UCSF email accounts. The breach exposed sensitive personal information of individuals, including **First Name, Last Name, Date of Birth, Medical Record Number (MRN), and Date of Service**. The exact number of affected individuals remains undetermined, but the compromised data poses risks of identity theft, medical fraud, or targeted scams. The attack exploited human vulnerability through phishing, leading to unauthorized access to employee email accounts, which likely contained or facilitated access to patient records. While no ransomware was involved, the exposure of **protected health information (PHI)**—particularly MRNs and service dates—heightens concerns over compliance violations (e.g., HIPAA) and potential misuse of medical data. The breach underscores the persistent threat of social engineering attacks in healthcare institutions, where employee credentials serve as gateways to highly sensitive systems.
University of California San Francisco
Ransomware
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The California Office of the Attorney General reported a data breach involving the University of California San Francisco (UCSF) on November 13, 2020. The breach occurred on June 1, 2020, due to a cybersecurity attack that resulted in unauthorized access to personal information, including names and social security numbers, affecting an unspecified number of individuals. UCSF paid the attacker to recover encrypted data and has offered credit monitoring services to impacted individuals.
USD Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for USD
Incidents vs Higher Education Industry Average (This Year)
No incidents recorded for UC San Diego in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for UC San Diego in 2025.
Incident Types USD vs Higher Education Industry Avg (This Year)
No incidents recorded for UC San Diego in 2025.
Incident History — USD (X = Date, Y = Severity)
USD cyber incidents detection timeline including parent company and subsidiaries
USD Company Subsidiaries
Recognized as one of the top 15 research universities worldwide, our culture of collaboration sparks discoveries that advance society and drive economic impact. Everything we do is dedicated to ensuring our students have the opportunity to become changemakers, equipped with the multidisciplinary tools needed to accelerate answers to our world’s most pressing issues.
Loading...
USD Similar Companies
McGill University
McGill University is one of Canada's best-known institutions of higher learning and one of the leading universities in the world. With students coming to McGill from some 150 countries, our student body is the most internationally diverse of any research-intensive university in the country. McGill
Cornell University
Cornell is a privately endowed research university and a partner of the State University of New York. As the federal land-grant institution in New York State, we have a responsibility—unique within the Ivy League—to make contributions in all fields of knowledge in a manner that prioritizes public en
The Johns Hopkins University
We are America’s first research university, founded in 1876 on the principle that by pursuing big ideas and sharing what we learn, we can make the world a better place. For more than 140 years, our faculty and students have worked side by side in pursuit of discoveries that improve lives. Johns Hop
Virginia Tech
Dedicated to its motto, Ut Prosim (That I May Serve), Virginia Tech takes a hands-on, engaging approach to education, preparing scholars to be leaders in their fields and communities. As the commonwealth’s most comprehensive university and its leading research institution, Virginia Tech offers 215 u
University of Oxford
Ranked number one in the world in the 2025 Times Higher Education World Rankings, we are at the forefront of the full range of academic disciplines, including medical sciences; mathematical, physical and life sciences; humanities; and social sciences. As the oldest university in the English-speaking
University of Maryland
As the State's flagship, the University of Maryland (UMD) strives to bring students deeply into the process of discovery, innovation and entrepreneurship. Whenever possible, hands-on research complements classroom instruction. Interdisciplinary collaborations facilitate the understanding of complex
University of Missouri-Columbia
We are Mizzou! Our distinct mission, as Missouri's only state-supported member of the Association of American Universities, is to provide all Missourians the benefits of a world-class research university. We are stewards and builders of a priceless state resource, a unique physical infrastructure an
University of Tehran
University of Tehran, an iconic institution of higher education in Iran, traces its origins back seven centuries to its foundation as a houza (traditional religious school). Over time, it evolved from this religious structure into a modern academic institution. About a century ago, the Dar-ol-Fonoon
The University of Queensland
For more than a century, The University of Queensland (UQ) has maintained a global reputation for delivering knowledge leadership for a better world. The most prestigious and widely recognised rankings of world universities consistently place UQ among the world's top universities. UQ has also wo
.png)
USD CyberSecurity News
November 21, 2025 11:12 PM
Protecting Patients’ Online Lives
Today, modern health care systems that are reliant on connected technologies are vulnerable to cyberattacks. Drs. Jeff Tully and Christian...
October 31, 2025 07:00 AM
Study concludes cybersecurity training doesn’t work
A lot of companies use cybersecurity training to prevent phishing attacks. A UC San Diego study says they should find a better way to...
October 31, 2025 07:00 AM
UCSD Center for Healthcare Cybersecurity fights attacks on multiple fronts
UCSD Center for Healthcare Cybersecurity fights attacks on multiple fronts · The center, launched in 2023, uses studies and collaboration with '...
October 21, 2025 07:00 AM
UC San Diego’s Center for Healthcare Cybersecurity Protects Patients and Keeps Hospitals Running
Internet surveillance. Another research initiative at the Center for Healthcare Cybersecurity involves continuously monitoring the internet via...
October 17, 2025 07:00 AM
Internet Security Project to Benefit U.S. Research and Education Networks
Scientists share vast amounts of data across institutions and borders, but hidden internet routing problems can quietly send that data off...
October 10, 2025 07:00 AM
UC San Diego Study: Standard Cybersecurity Training Fails to Reduce Phishing Clicks
In the ever-evolving world of cybersecurity, where threats like phishing scams cost businesses billions annually, a new study is challenging...
October 09, 2025 07:00 AM
Why cybersecurity training isn’t enough to stop phishing hacks
New research from UC San Diego reveals that generic cybersecurity training often fails to capture people's attention.
October 01, 2025 07:00 AM
Cybersecurity training fails to stop phishing: UCSD study
Cybersecurity training fails to stop phishing: UCSD study ... Cybersecurity training programs, as commonly implemented in large organizations, do...
September 29, 2025 07:00 AM
Phishing training doesn't stop your employees from clicking scam links - here's why
A UC San Diego study found phishing training programs are basically useless, with employees just as likely to click scam emails whether or...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
USD CyberSecurity History Information
Official Website of UC San Diego
The official website of UC San Diego is http://ucsd.edu.
UC San Diego’s AI-Generated Cybersecurity Score
According to Rankiteo, UC San Diego’s AI-generated cybersecurity score is 805, reflecting their Good security posture.
How many security badges does UC San Diego’ have ?
According to Rankiteo, UC San Diego currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does UC San Diego have SOC 2 Type 1 certification ?
According to Rankiteo, UC San Diego is not certified under SOC 2 Type 1.
Does UC San Diego have SOC 2 Type 2 certification ?
According to Rankiteo, UC San Diego does not hold a SOC 2 Type 2 certification.
Does UC San Diego comply with GDPR ?
According to Rankiteo, UC San Diego is not listed as GDPR compliant.
Does UC San Diego have PCI DSS certification ?
According to Rankiteo, UC San Diego does not currently maintain PCI DSS compliance.
Does UC San Diego comply with HIPAA ?
According to Rankiteo, UC San Diego is not compliant with HIPAA regulations.
Does UC San Diego have ISO 27001 certification ?
According to Rankiteo,UC San Diego is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of UC San Diego
UC San Diego operates primarily in the Higher Education industry.
Number of Employees at UC San Diego
UC San Diego employs approximately 19,749 people worldwide.
Subsidiaries Owned by UC San Diego
UC San Diego presently has no subsidiaries across any sectors.
UC San Diego’s LinkedIn Followers
UC San Diego’s official LinkedIn profile has approximately 408,357 followers.
NAICS Classification of UC San Diego
UC San Diego is classified under the NAICS code 6113, which corresponds to Colleges, Universities, and Professional Schools.
UC San Diego’s Presence on Crunchbase
No, UC San Diego does not have a profile on Crunchbase.
UC San Diego’s Presence on LinkedIn
Yes, UC San Diego maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/ucsandiego.
Cybersecurity Incidents Involving UC San Diego
As of November 27, 2025, Rankiteo reports that UC San Diego has experienced 19 cybersecurity incidents.
Number of Peer and Competitor Companies
UC San Diego has an estimated 14,032 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at UC San Diego ?
Incident Types: The types of cybersecurity incidents that have occurred include Ransomware, Breach and Data Leak.
What was the total financial impact of these incidents on UC San Diego ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $12.14 million.
How does UC San Diego detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with retraining involved personnel, remediation measures with notifying affected patients, and third party assistance with external security experts, and communication strategy with notifies the affected patients, and communication strategy with individuals were notified, and the letters each person receives precisely reflect the information that would have been impacted for that particular person., and containment measures with disabled the use of the tools, and communication strategy with public disclosure via california office of the attorney general, and communication strategy with public disclosure via california office of the attorney general..
Incident Details
Can you provide details on each incident ?
Title: UCLA Health Data Breach
Description: UCLA Health experienced a data breach incident in September 2015 after one of its laptops got stolen. The stolen laptop contained the personal information of approximately 1,242 patients of the organization including names and medical record numbers. UCLA Health notified all affected patients and retrained those involved with the incident.
Date Detected: 2015-09
Type: Data Breach
Attack Vector: Theft of Laptop
Title: Unauthorized Access to Patient Records at UC Irvine Medical Center
Description: An employee of UC Irvine Medical Center unethically viewed thousands of patient records over a four-year period. The incident compromised the personal health information including names, dates of birth, gender, medical record numbers, height, weight, medical center account numbers, allergy information, home address, medical documentation, diagnoses, test orders and results, of 4,859 patients.
Type: Data Breach
Attack Vector: Unauthorized Access
Vulnerability Exploited: Insider Threat
Threat Actor: Employee
Motivation: Unethical Behavior
Title: UC San Diego Health Data Breach
Description: UC San Diego Health suffered from a data breach that exposed the information of patients, employees, and others connected to UC San Diego Health potentially.
Type: Data Breach
Attack Vector: Unauthorized access to employee email accounts
Title: UCLA Health Data Breach
Description: UCLA Health experienced a data breach incident affecting 94,000 patients' personal information and health data to third parties.
Type: Data Breach
Title: MOVEit Transfer Vulnerability Exploitation by Clop Ransomware Group
Description: The Clop ransomware group exploited the MOVEit Transfer vulnerability CVE-2023-34362 to compromise multiple organizations, including Siemens Energy, Schneider Electric, Werum, UCLA, and AbbVie.
Type: Data Breach and Ransomware Attack
Attack Vector: Vulnerability Exploitation
Vulnerability Exploited: CVE-2023-34362
Threat Actor: Clop Ransomware Group
Motivation: Financial Gain
Title: UC San Diego Health Ransomware Attack
Description: UC San Diego Health experienced a ransomware attack threatening critical healthcare operations. As the medical industry increases reliance on technology, such attacks can have dire consequences on patient care and outcomes. The attack's costliness, with an average of $11 million according to IBM, poses risks to smaller healthcare systems' existence, potentially leading to their permanent closure. Patients in remote areas would be most affected due to the scarcity of nearby medical facilities. In response, federal funding has been allocated to develop better preventative and mitigative measures, focusing on cybersecurity in healthcare.
Type: Ransomware
Motivation: Financial Gain
Title: UCSF Ransomware Attack
Description: The University of California San Francisco suffered a significant ransomware attack at the hands of the NetWalker group, which resulted in the loss of access to critical data. In order to recover the encrypted files, UCSF was compelled to pay a substantial ransom of $1.14 million. This incident stressed the vulnerability of major institutions to sophisticated cyber threats, particularly during sensitive times such as the COVID-19 pandemic when reliance on digital infrastructure is at its peak. The attack not only financially impacted the university but also highlighted the potential risks to privacy and the continuation of essential services.
Type: Ransomware
Threat Actor: NetWalker group
Motivation: Financial Gain
Title: UCSF Medical Center Data Breach
Description: The California Office of the Attorney General reported a data breach involving UCSF Medical Center on October 2, 2013. The breach occurred on September 9, 2013, due to the theft of an unencrypted laptop from a locked vehicle, potentially affecting health information of individuals, including names and medical record numbers.
Date Detected: 2013-09-09
Date Publicly Disclosed: 2013-10-02
Type: Data Breach
Attack Vector: Theft of Unencrypted Laptop
Vulnerability Exploited: Physical Security
Title: UC San Diego Health Data Breach
Description: The California Office of the Attorney General reported that UC San Diego Health experienced a data breach due to a phishing attack, which occurred between January 9 and January 22, 2024. The breach involved unauthorized access to employee email accounts, potentially exposing personal information such as names and Social Security numbers, affecting an unspecified number of individuals. The breach was reported on March 8, 2024.
Date Detected: 2024-03-08
Date Publicly Disclosed: 2024-03-08
Type: Data Breach
Attack Vector: Phishing
Vulnerability Exploited: Human
Title: Data Breach at University of California San Francisco
Description: The California Office of the Attorney General reported a data breach involving the University of California San Francisco (UCSF) on November 13, 2020. The breach occurred on June 1, 2020, due to a cybersecurity attack that resulted in unauthorized access to personal information, including names and social security numbers, affecting an unspecified number of individuals. UCSF paid the attacker to recover encrypted data and has offered credit monitoring services to impacted individuals.
Date Detected: 2020-06-01
Date Publicly Disclosed: 2020-11-13
Type: Data Breach
Title: Data Breach at UC San Diego Health
Description: An unauthorized third party accessed a medical transcription platform, potentially compromising patient data such as names, dates of birth, and clinical information, but did not access Social Security numbers or financial account information.
Date Publicly Disclosed: 2019-06-14
Type: Data Breach
Attack Vector: Unauthorized Access
Threat Actor: Unauthorized Third Party
Title: Data Breach at University of California San Francisco (UCSF)
Description: A data breach occurred when an unencrypted personal laptop containing identifiable health information was stolen from a physician's locked vehicle.
Date Detected: 2013-09-25
Date Publicly Disclosed: 2013-11-21
Type: Data Breach
Attack Vector: Physical Theft
Vulnerability Exploited: Unencrypted Data
Threat Actor: Unknown
Motivation: Unknown
Title: UC San Diego School of Medicine Data Breach
Description: The California Office of the Attorney General reported that UC San Diego School of Medicine experienced a data breach involving personal information including names and social security numbers of trainees.
Date Detected: 2016-08-03
Date Publicly Disclosed: 2016-09-22
Type: Data Breach
Title: Data Breach at University of California
Description: The California Office of the Attorney General reported a data breach at the University of California on May 13, 2021. The breach occurred on December 24, 2020, when an unauthorized third party accessed files containing personal information of UC community members, including Social Security numbers and financial information. Approximately 100 organizations were similarly attacked, but the number of affected individuals specific to UC is unknown.
Date Detected: 2021-05-13
Date Publicly Disclosed: 2021-05-13
Type: Data Breach
Attack Vector: Unauthorized Access
Threat Actor: Unauthorized Third Party
Title: UC San Diego Health Data Breach
Description: Unauthorized access to employee email accounts compromising personal information including Social Security numbers and medical details.
Date Detected: April 8, 2021
Date Publicly Disclosed: September 9, 2021
Type: Data Breach
Attack Vector: Email Compromise
Title: Data Breach at University of California, San Francisco (UCSF) via Phishing Attack
Description: The California Office of the Attorney General reported a data breach involving the University of California, San Francisco (UCSF) on April 26, 2023. The breach occurred on February 9, 2023, due to a phishing attack that compromised some UCSF email accounts, potentially exposing individuals' First Name, Last Name, Date of Birth, MRN (Medical Record Number), and Date of Service. The number of individuals affected is currently unknown.
Date Detected: 2023-02-09
Date Publicly Disclosed: 2023-04-26
Type: Data Breach
Attack Vector: Phishing
Title: UC San Diego Health Data Breach via Vendor Solv Health
Description: The California Office of the Attorney General reported that UC San Diego Health experienced a data breach involving its vendor, Solv Health, between September 13 and December 22, 2022. The breach may have compromised personal information such as names, dates of birth, email addresses, and insurance types for individuals who used scheduling websites, affecting an unknown number of individuals.
Type: Data Breach
Title: University of California Irvine Medical Center Data Breach (2011-2015)
Description: An employee improperly accessed patient records between June 2011 and March 2015 at the University of California Irvine Medical Center. The breach potentially affected an unknown number of patients, exposing various personal health information, but no evidence was found of sensitive information being removed.
Date Detected: 2015-03-01
Date Publicly Disclosed: 2015-06-17
Type: Data Breach (Insider Threat)
Attack Vector: Insider Access Abuse
Threat Actor: Internal Employee
Motivation: Unknown (Potentially Unauthorized Curiosity or Malicious Intent)
Title: University of California, Irvine Data Breach (2014)
Description: The California Office of the Attorney General reported a data breach by the University of California, Irvine on May 14, 2014. The breach involved unauthorized access to computers infected with a keystroke logger between February 14 and March 27, 2014, potentially affecting personal information for individuals, including unencrypted medical data. The number of individuals affected is unknown.
Date Detected: 2014-03-27
Date Publicly Disclosed: 2014-05-14
Type: Data Breach
Attack Vector: Keystroke Logger (Malware)
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Employee email accounts, Phishing email, Email Compromise and Phishing (compromised email accounts).
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach UCL14320422
Data Compromised: Names, Medical record numbers
Incident : Data Breach UCI2241522
Data Compromised: Names, Dates of birth, Gender, Medical record numbers, Height, Weight, Medical center account numbers, Allergy information, Home address, Medical documentation, Diagnoses, Test orders and results
Incident : Data Breach UCS22335223
Data Compromised: Full names, Addresses, Dates of birth, Email addresses, Fax numbers, Claims information including dates and costs of care received, Laboratory results, Medical diagnoses and conditions, Medical record numbers, Prescription information, Treatment information, Social security numbers, Government identification numbers, Financial account numbers, Student identification numbers, Usernames and passwords
Incident : Data Breach UCL11139223
Data Compromised: Url/website addresses, Provider names, Specialty, Ad campaign names, Page views, Ip addresses, Third-party cookies, Hashed values of certain fields on the appointment request form, such as patient names, email addresses, mailing addresses, phone numbers, and genders
Systems Affected: UCLA Health websiteUCLA Health mobile app
Incident : Ransomware UCS1014070724
Financial Loss: Average of $11 million
Systems Affected: Critical healthcare operations
Operational Impact: Threat to patient care and outcomes
Incident : Ransomware UCS000122224
Financial Loss: $1.14 million
Systems Affected: Critical data systems
Operational Impact: Loss of access to critical data
Incident : Data Breach UCS158072625
Data Compromised: Names, Medical record numbers
Incident : Data Breach UCS108072625
Data Compromised: Names, Social security numbers
Systems Affected: Employee email accounts
Incident : Data Breach UCS658072625
Data Compromised: Names, Social security numbers
Incident : Data Breach UCS827072625
Data Compromised: Names, Dates of birth, Clinical information
Systems Affected: Medical Transcription Platform
Incident : Data Breach UCS212072625
Data Compromised: Identifiable Health Information
Systems Affected: Personal Laptop
Incident : Data Breach UCS457072625
Data Compromised: Names, Social security numbers
Incident : Data Breach UCO831072725
Data Compromised: Social security numbers, Financial information
Incident : Data Breach UCS913080425
Data Compromised: Social security numbers, Medical details
Incident : Data Breach UCS157082025
Data Compromised: First name, Last name, Date of birth, Mrn, Date of service
Systems Affected: Email Accounts
Identity Theft Risk: Potential (PII exposed)
Incident : Data Breach UCS1016090725
Data Compromised: Names, Dates of birth, Email addresses, Insurance types
Systems Affected: scheduling websites
Identity Theft Risk: Potential
Incident : Data Breach (Insider Threat) UC-952091725
Data Compromised: Personal health information (phi)
Brand Reputation Impact: Potential Reputational Harm (Healthcare Trust Erosion)
Identity Theft Risk: Low (No Evidence of Data Exfiltration)
Incident : Data Breach UC-013091825
Data Compromised: Personal information, Unencrypted medical data
Systems Affected: Computers
Identity Theft Risk: Potential
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $638.95 thousand.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personal Information, , Names, Dates Of Birth, Gender, Medical Record Numbers, Height, Weight, Medical Center Account Numbers, Allergy Information, Home Address, Medical Documentation, Diagnoses, Test Orders And Results, , Full Names, Addresses, Dates Of Birth, Email Addresses, Fax Numbers, Claims Information Including Dates And Costs Of Care Received, Laboratory Results, Medical Diagnoses And Conditions, Medical Record Numbers, Prescription Information, Treatment Information, Social Security Numbers, Government Identification Numbers, Financial Account Numbers, Student Identification Numbers, Usernames And Passwords, , Personal Information, Health Data, , Names, Medical Record Numbers, , Names, Social Security Numbers, , Names, Social Security Numbers, , Names, Dates Of Birth, Clinical Information, , Identifiable Health Information, Names, Social Security Numbers, , Social Security Numbers, Financial Information, , Social Security Numbers, Medical Details, , Personally Identifiable Information (Pii), Protected Health Information (Phi), , Personal Information, , Personal Health Information (PHI), Personal Information, Medical Data and .
Which entities were affected by each incident ?
Incident : Data Breach UCL14320422
Entity Name: UCLA Health
Entity Type: Healthcare Provider
Industry: Healthcare
Customers Affected: 1,242
Incident : Data Breach UCI2241522
Entity Name: UC Irvine Medical Center
Entity Type: Hospital
Industry: Healthcare
Location: Irvine, CA
Customers Affected: 4,859 patients
Incident : Data Breach UCS22335223
Entity Name: UC San Diego Health
Entity Type: Healthcare
Industry: Healthcare
Location: San Diego, CA
Incident : Data Breach UCL11139223
Entity Name: UCLA Health
Entity Type: Healthcare Provider
Industry: Healthcare
Location: Los Angeles, California
Customers Affected: 94,000
Incident : Data Breach and Ransomware Attack UCL0443723
Entity Name: Siemens Energy
Entity Type: Industrial Control Systems Provider
Industry: Energy
Incident : Data Breach and Ransomware Attack UCL0443723
Entity Name: Schneider Electric
Entity Type: Industrial Control Systems Provider
Industry: Energy Management and Automation
Incident : Data Breach and Ransomware Attack UCL0443723
Entity Name: Werum
Entity Type: Software Company
Industry: Pharmaceuticals and Biotech
Incident : Data Breach and Ransomware Attack UCL0443723
Entity Name: UCLA
Entity Type: University
Industry: Education
Location: Los Angeles, CA
Incident : Data Breach and Ransomware Attack UCL0443723
Entity Name: AbbVie
Entity Type: Pharmaceutical Company
Industry: Pharmaceuticals
Incident : Ransomware UCS1014070724
Entity Name: UC San Diego Health
Entity Type: Healthcare Provider
Industry: Healthcare
Location: San Diego, California
Incident : Ransomware UCS000122224
Entity Name: University of California San Francisco
Entity Type: Educational Institution
Industry: Education
Location: San Francisco, CA
Incident : Data Breach UCS158072625
Entity Name: UCSF Medical Center
Entity Type: Healthcare
Industry: Healthcare
Location: California
Incident : Data Breach UCS108072625
Entity Name: UC San Diego Health
Entity Type: Healthcare
Industry: Healthcare
Location: San Diego, California
Incident : Data Breach UCS658072625
Entity Name: University of California San Francisco
Entity Type: Educational Institution
Industry: Education
Location: San Francisco, California
Incident : Data Breach UCS827072625
Entity Name: UC San Diego Health
Entity Type: Healthcare
Industry: Healthcare
Location: San Diego, California
Incident : Data Breach UCS212072625
Entity Name: University of California San Francisco (UCSF)
Entity Type: Educational Institution
Industry: Healthcare
Location: San Francisco, California
Incident : Data Breach UCS457072625
Entity Name: UC San Diego School of Medicine
Entity Type: Educational Institution
Industry: Education
Location: San Diego, California
Incident : Data Breach UCO831072725
Entity Name: University of California
Entity Type: Educational Institution
Industry: Education
Location: California
Incident : Data Breach UCS913080425
Entity Name: UC San Diego Health
Entity Type: Healthcare
Industry: Healthcare
Location: San Diego, California
Incident : Data Breach UCS157082025
Entity Name: University of California, San Francisco (UCSF)
Entity Type: Educational Institution / Healthcare Provider
Industry: Education, Healthcare
Location: San Francisco, California, USA
Customers Affected: Unknown
Incident : Data Breach UCS1016090725
Entity Name: UC San Diego Health
Entity Type: Healthcare Provider
Industry: Healthcare
Location: California, USA
Customers Affected: Unknown
Incident : Data Breach UCS1016090725
Entity Name: Solv Health
Entity Type: Vendor
Industry: Healthcare Technology
Customers Affected: Unknown
Incident : Data Breach (Insider Threat) UC-952091725
Entity Name: University of California Irvine Medical Center
Entity Type: Healthcare Provider / Academic Medical Center
Industry: Healthcare
Location: Orange, California, USA
Customers Affected: Unknown (Patients)
Incident : Data Breach UC-013091825
Entity Name: University of California, Irvine
Entity Type: Educational Institution
Industry: Higher Education
Location: Irvine, California, USA
Customers Affected: Unknown
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach UCL14320422
Remediation Measures: Retraining involved personnelNotifying affected patients
Incident : Data Breach UCI2241522
Third Party Assistance: external security experts
Communication Strategy: notifies the affected patients
Incident : Data Breach UCS22335223
Communication Strategy: Individuals were notified, and the letters each person receives precisely reflect the information that would have been impacted for that particular person.
Incident : Data Breach UCL11139223
Containment Measures: Disabled the use of the tools
Incident : Data Breach UCS157082025
Communication Strategy: Public disclosure via California Office of the Attorney General
Incident : Data Breach (Insider Threat) UC-952091725
Communication Strategy: Public Disclosure via California Office of the Attorney General
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through external security experts.
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach UCL14320422
Type of Data Compromised: Personal information
Number of Records Exposed: 1,242
Sensitivity of Data: High
Personally Identifiable Information: NamesMedical Record Numbers
Incident : Data Breach UCI2241522
Type of Data Compromised: Names, Dates of birth, Gender, Medical record numbers, Height, Weight, Medical center account numbers, Allergy information, Home address, Medical documentation, Diagnoses, Test orders and results
Number of Records Exposed: 4,859
Sensitivity of Data: High
Personally Identifiable Information: namesdates of birthgendermedical record numbersheightweightmedical center account numbersallergy informationhome address
Incident : Data Breach UCS22335223
Type of Data Compromised: Full names, Addresses, Dates of birth, Email addresses, Fax numbers, Claims information including dates and costs of care received, Laboratory results, Medical diagnoses and conditions, Medical record numbers, Prescription information, Treatment information, Social security numbers, Government identification numbers, Financial account numbers, Student identification numbers, Usernames and passwords
Sensitivity of Data: High
Incident : Data Breach UCL11139223
Type of Data Compromised: Personal information, Health data
Number of Records Exposed: 94,000
Sensitivity of Data: High
Personally Identifiable Information: Patient namesEmail addressesMailing addressesPhone numbersGenders
Incident : Data Breach UCS158072625
Type of Data Compromised: Names, Medical record numbers
Sensitivity of Data: High
Data Encryption: No
Personally Identifiable Information: Yes
Incident : Data Breach UCS108072625
Type of Data Compromised: Names, Social security numbers
Sensitivity of Data: High
Incident : Data Breach UCS658072625
Type of Data Compromised: Names, Social security numbers
Incident : Data Breach UCS827072625
Type of Data Compromised: Names, Dates of birth, Clinical information
Sensitivity of Data: High
Personally Identifiable Information: NamesDates of Birth
Incident : Data Breach UCS212072625
Type of Data Compromised: Identifiable Health Information
Sensitivity of Data: High
Data Encryption: No
Personally Identifiable Information: Yes
Incident : Data Breach UCS457072625
Type of Data Compromised: Names, Social security numbers
Sensitivity of Data: High
Incident : Data Breach UCO831072725
Type of Data Compromised: Social security numbers, Financial information
Sensitivity of Data: High
Personally Identifiable Information: Social Security numbers
Incident : Data Breach UCS913080425
Type of Data Compromised: Social security numbers, Medical details
Sensitivity of Data: High
Incident : Data Breach UCS157082025
Type of Data Compromised: Personally identifiable information (pii), Protected health information (phi)
Number of Records Exposed: Unknown
Sensitivity of Data: High (includes MRN and PHI)
Personally Identifiable Information: First NameLast NameDate of BirthMRNDate of Service
Incident : Data Breach UCS1016090725
Type of Data Compromised: Personal information
Number of Records Exposed: Unknown
Sensitivity of Data: Moderate (PII)
Data Exfiltration: Likely
Personally Identifiable Information: namesdates of birthemail addresses
Incident : Data Breach (Insider Threat) UC-952091725
Type of Data Compromised: Personal Health Information (PHI)
Number of Records Exposed: Unknown
Sensitivity of Data: High (Health Records)
Data Exfiltration: No Evidence
Personally Identifiable Information: Likely (PHI includes PII elements)
Incident : Data Breach UC-013091825
Type of Data Compromised: Personal information, Medical data
Number of Records Exposed: Unknown
Sensitivity of Data: High (Unencrypted Medical Data)
Data Exfiltration: Potential
Data Encryption: No (Data was unencrypted)
Personally Identifiable Information: Yes
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Retraining involved personnel, Notifying affected patients, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by disabled the use of the tools.
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Data Breach and Ransomware Attack UCL0443723
Ransomware Strain: Clop
Incident : Ransomware UCS000122224
Ransom Demanded: $1.14 million
Ransom Paid: $1.14 million
Ransomware Strain: NetWalker
Data Encryption: Yes
Incident : Data Breach UCS658072625
Data Encryption: True
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach UCS157082025
Regulations Violated: Potentially HIPAA (Health Insurance Portability and Accountability Act), California Consumer Privacy Act (CCPA),
Regulatory Notifications: California Office of the Attorney General
Incident : Data Breach UCS1016090725
Regulatory Notifications: California Office of the Attorney General
Incident : Data Breach (Insider Threat) UC-952091725
Regulations Violated: HIPAA (Potential Violation), California Data Breach Notification Law,
Regulatory Notifications: California Office of the Attorney General
Incident : Data Breach UC-013091825
Regulatory Notifications: California Office of the Attorney General
Lessons Learned and Recommendations
What recommendations were made to prevent future incidents ?
Incident : Ransomware UCS1014070724
Recommendations: Federal funding allocated to develop better preventative and mitigative measures, focusing on cybersecurity in healthcare.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Federal funding allocated to develop better preventative and mitigative measures and focusing on cybersecurity in healthcare..
References
Where can I find more information about each incident ?
Incident : Data Breach UCL11139223
Source: UCLA Health
Incident : Data Breach UCS158072625
Source: California Office of the Attorney General
Date Accessed: 2013-10-02
Incident : Data Breach UCS108072625
Source: California Office of the Attorney General
Date Accessed: 2024-03-08
Incident : Data Breach UCS658072625
Source: California Office of the Attorney General
Date Accessed: 2020-11-13
Incident : Data Breach UCS827072625
Source: California Office of the Attorney General
Incident : Data Breach UCS212072625
Source: California Office of the Attorney General
Incident : Data Breach UCS457072625
Source: California Office of the Attorney General
Incident : Data Breach UCO831072725
Source: California Office of the Attorney General
Date Accessed: 2021-05-13
Incident : Data Breach UCS913080425
Source: California Office of the Attorney General
Date Accessed: September 9, 2021
Incident : Data Breach UCS157082025
Source: California Office of the Attorney General
Date Accessed: 2023-04-26
Incident : Data Breach UCS1016090725
Source: California Office of the Attorney General
Incident : Data Breach (Insider Threat) UC-952091725
Source: California Office of the Attorney General
Date Accessed: 2015-06-17
Incident : Data Breach UC-013091825
Source: California Office of the Attorney General
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: UCLA Health, and Source: UCLAUrl: http://ucla.edu, and Source: AbbVieUrl: http://abbvie.com, and Source: California Office of the Attorney GeneralDate Accessed: 2013-10-02, and Source: California Office of the Attorney GeneralDate Accessed: 2024-03-08, and Source: California Office of the Attorney GeneralDate Accessed: 2020-11-13, and Source: California Office of the Attorney General, and Source: California Office of the Attorney General, and Source: California Office of the Attorney General, and Source: California Office of the Attorney GeneralDate Accessed: 2021-05-13, and Source: California Office of the Attorney GeneralDate Accessed: September 9, 2021, and Source: California Office of the Attorney GeneralDate Accessed: 2023-04-26, and Source: California Office of the Attorney General, and Source: California Office of the Attorney GeneralDate Accessed: 2015-06-17, and Source: California Office of the Attorney General.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach UCL11139223
Investigation Status: Ongoing
Incident : Data Breach (Insider Threat) UC-952091725
Investigation Status: Completed (No Evidence of Data Theft)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through notifies the affected patients, Individuals were notified, and the letters each person receives precisely reflect the information that would have been impacted for that particular person., Public disclosure via California Office of the Attorney General and Public Disclosure via California Office of the Attorney General.
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Data Breach UCS22335223
Entry Point: Employee email accounts
Incident : Data Breach UCS108072625
Entry Point: Phishing email
Incident : Data Breach UCS913080425
Entry Point: Email Compromise
Incident : Data Breach UCS157082025
Entry Point: Phishing (compromised email accounts)
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach (Insider Threat) UC-952091725
Root Causes: Lack of Access Controls / Monitoring for Insider Threats
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as external security experts.
Additional Questions
General Information
Has the company ever paid ransoms ?
Ransom Payment History: The company has Paid ransoms in the past.
What was the amount of the last ransom demanded ?
Last Ransom Demanded: The amount of the last ransom demanded was $1.14 million.
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Employee, Clop Ransomware Group, NetWalker group, Unauthorized Third Party, Unknown, Unauthorized Third Party and Internal Employee.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2015-09.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2014-05-14.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was $1.14 million.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Names, Medical Record Numbers, , names, dates of birth, gender, medical record numbers, height, weight, medical center account numbers, allergy information, home address, medical documentation, diagnoses, test orders and results, , full names, addresses, dates of birth, email addresses, fax numbers, claims information including dates and costs of care received, laboratory results, medical diagnoses and conditions, medical record numbers, prescription information, treatment information, Social Security numbers, government identification numbers, financial account numbers, student identification numbers, usernames and passwords, , URL/website addresses, Provider names, Specialty, Ad campaign names, Page views, IP addresses, Third-party cookies, Hashed values of certain fields on the appointment request form, such as patient names, email addresses, mailing addresses, phone numbers, and genders, , Names, Medical Record Numbers, , Names, Social Security numbers, , names, social security numbers, , Names, Dates of Birth, Clinical Information, , Identifiable Health Information, names, social security numbers, , Social Security numbers, Financial information, , Social Security numbers, medical details, , First Name, Last Name, Date of Birth, MRN, Date of Service, , names, dates of birth, email addresses, insurance types, , Personal Health Information (PHI), , Personal Information, Unencrypted Medical Data and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was UCLA Health websiteUCLA Health mobile app and and and Employee email accounts and Medical Transcription Platform and and Email Accounts and scheduling websites and Computers.
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was external security experts.
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Disabled the use of the tools.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were government identification numbers, dates of birth, financial account numbers, Last Name, allergy information, treatment information, Clinical Information, test orders and results, addresses, fax numbers, student identification numbers, Ad campaign names, Dates of Birth, medical details, Names, height, Unencrypted Medical Data, gender, Medical Record Numbers, medical record numbers, medical center account numbers, Provider names, social security numbers, Financial information, medical diagnoses and conditions, Hashed values of certain fields on the appointment request form, such as patient names, email addresses, mailing addresses, phone numbers, and genders, weight, Specialty, Date of Birth, IP addresses, insurance types, usernames and passwords, email addresses, Identifiable Health Information, names, Page views, First Name, URL/website addresses, full names, prescription information, Social Security numbers, Third-party cookies, Date of Service, Personal Health Information (PHI), claims information including dates and costs of care received, Personal Information, MRN, laboratory results, diagnoses, home address and medical documentation.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 100.1K.
Ransomware Information
What was the highest ransom demanded in a ransomware incident ?
Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was $1.14 million.
What was the highest ransom paid in a ransomware incident ?
Highest Ransom Paid: The highest ransom paid in a ransomware incident was $1.14 million.
Lessons Learned and Recommendations
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Federal funding allocated to develop better preventative and mitigative measures and focusing on cybersecurity in healthcare..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are AbbVie, UCLA Health, UCLA and California Office of the Attorney General.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is http://ucla.edu, http://abbvie.com .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an Employee email accounts, Email Compromise, Phishing (compromised email accounts) and Phishing email.
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=ucsandiego' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
