The University of California, San Francisco (UCSF) experienced a data breach on February 9, 2023, disclosed on April 26, 2023, due to a phishing attack targeting UCSF email accounts. The breach exposed sensitive personal information of individuals, including First Name, Last Name, Date of Birth, Medical Record Number (MRN), and Date of Service. The exact number of affected individuals remains undetermined, but the compromised data poses risks of identity theft, medical fraud, or targeted scams. The attack exploited human vulnerability through phishing, leading to unauthorized access to employee email accounts, which likely contained or facilitated access to patient records. While no ransomware was involved, the exposure of protected health information (PHI)—particularly MRNs and service dates—heightens concerns over compliance violations (e.g., HIPAA) and potential misuse of medical data. The breach underscores the persistent threat of social engineering attacks in healthcare institutions, where employee credentials serve as gateways to highly sensitive systems.

The California Office of the Attorney General reported a data breach involving the University of California San Francisco (UCSF) on November 13, 2020. The breach occurred on June 1, 2020, due to a cybersecurity attack that resulted in unauthorized access to personal information, including names and social security numbers, affecting an unspecified number of individuals. UCSF paid the attacker to recover encrypted data and has offered credit monitoring services to impacted individuals.

The California Office of the Attorney General reported a data breach involving the University of California San Francisco (UCSF) on November 21, 2013. The breach occurred on September 25, 2013, when an unencrypted personal laptop containing identifiable health information was stolen from a physician's locked vehicle. The stolen laptop contained sensitive health information, which could potentially compromise the privacy and security of the affected individuals.