UU
Company Details
Linkedin ID:
university-of-utah
Website:
Employees number:
11,323
Number of followers:
265,203
NAICS:
6113
Industry Type:
Homepage:
utah.edu
IP Addresses:
0
Company ID:
UNI_2878743
Scan Status:
In-progress
University of Utah Company CyberSecurity Posture
utah.edu
The University of Utah, located in Salt Lake City in the foothills of the Wasatch Mountains, is the flagship institution of higher learning in Utah. Founded in 1850, it serves over 31,000 students from across the U.S. and the world. With over 72 major subjects at the undergraduate level and more than 90 major fields of study at the graduate level, including law and medicine, the university prepares students to live and compete in the global workplace. Known for its proximity to seven world-class ski resorts within 40 minutes of campus, the U encourages an active, holistic lifestyle, innovation and collaborative thinking to engage students, faculty and business leaders. The University of Utah became a member of the PAC-12 conference in July 2011. Technology and Commercialization The University of Utah is tops in the country for creating start-up companies from university research, according to a ranking by the Association of University Technology Managers (AUTM). See http://unews.utah.edu/news_releases/u-of-utah-no-1-for-startups for more information. Forbes magazine’s recent ranking of the “Best States for Business” pointed to “an educated labor force” as a big reason Utah came in at number one. The U supplies many of the employees for companies that keep expanding their operations in Utah, such as Goldman Sachs, Adobe, Omniture, Oracle, Ebay and many others. http://pac12info.utah.edu/commercialization-of-innovation/ Healthcare University of Utah Health Care recently ranked first in the nation in a prestigious national study. The University Health System Consortium’s 2010 Quality and Accountability Study compared 98 of the nation’s top academic medical centers and ranked them based on core quality measures, patient safety indicators, mortality rates, re-admission rates, and patient satisfaction scores. See more about University of Utah Health Care at http://healthcare.utah.edu/index.php
University of Utah A.I CyberSecurity Scoring
UU Risk Score (AI oriented)Between 700 and 749
UU
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
UU Global Score (TPRM)XXXX
UU
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
UU Company CyberSecurity News & History
Past Incidents
2
Attack Types
2
University of Utah
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The University of Utah experienced a data breach. The incident affected 10,000 patients and involved PHI located in the email. The University of Utah notified patients after the phishing attack.
University of Utah
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: The University of Utah has paid around $457,000 after its College of Social and Behavioral Science servers were attacked by hackers. The attack impacted the data of both employees and students but the IT services and systems were restored from backup copies.
UU Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for UU
Incidents vs Higher Education Industry Average (This Year)
No incidents recorded for University of Utah in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for University of Utah in 2025.
Incident Types UU vs Higher Education Industry Avg (This Year)
No incidents recorded for University of Utah in 2025.
Incident History — UU (X = Date, Y = Severity)
UU cyber incidents detection timeline including parent company and subsidiaries
UU Company Subsidiaries
The University of Utah, located in Salt Lake City in the foothills of the Wasatch Mountains, is the flagship institution of higher learning in Utah. Founded in 1850, it serves over 31,000 students from across the U.S. and the world. With over 72 major subjects at the undergraduate level and more than 90 major fields of study at the graduate level, including law and medicine, the university prepares students to live and compete in the global workplace. Known for its proximity to seven world-class ski resorts within 40 minutes of campus, the U encourages an active, holistic lifestyle, innovation and collaborative thinking to engage students, faculty and business leaders. The University of Utah became a member of the PAC-12 conference in July 2011. Technology and Commercialization The University of Utah is tops in the country for creating start-up companies from university research, according to a ranking by the Association of University Technology Managers (AUTM). See http://unews.utah.edu/news_releases/u-of-utah-no-1-for-startups for more information. Forbes magazine’s recent ranking of the “Best States for Business” pointed to “an educated labor force” as a big reason Utah came in at number one. The U supplies many of the employees for companies that keep expanding their operations in Utah, such as Goldman Sachs, Adobe, Omniture, Oracle, Ebay and many others. http://pac12info.utah.edu/commercialization-of-innovation/ Healthcare University of Utah Health Care recently ranked first in the nation in a prestigious national study. The University Health System Consortium’s 2010 Quality and Accountability Study compared 98 of the nation’s top academic medical centers and ranked them based on core quality measures, patient safety indicators, mortality rates, re-admission rates, and patient satisfaction scores. See more about University of Utah Health Care at http://healthcare.utah.edu/index.php
Loading...
UU Similar Companies
University of Waterloo
University of Waterloo is a leader in innovation that drives economic and social prosperity for Canada and the world. We are home to a renowned talent pipeline, game-changing research and technology, and unmatched entrepreneurial culture, that together create solutions to tackle today’s and tomorrow
Virginia Tech
Dedicated to its motto, Ut Prosim (That I May Serve), Virginia Tech takes a hands-on, engaging approach to education, preparing scholars to be leaders in their fields and communities. As the commonwealth’s most comprehensive university and its leading research institution, Virginia Tech offers 215 u
Western Governors University
WGU, www.wgu.edu, is an online university for the 21st century. We are driven by a mission to expand access to higher education through online, competency-based degree programs. Since its establishment in 1997, WGU has grown into a national university, serving more than 120,000 students from all 50
University of Minnesota
One of the nation’s largest schools, the University of Minnesota offers baccalaureate, master’s, and doctoral degrees in virtually every field—from medicine to business, law to liberal arts, and science and engineering to architecture. The University of Minnesota system is made up of five campuses
University of Kentucky
The University of Kentucky is a public, research-extensive, land grant university dedicated to improving people's lives through excellence in teaching, research, health care, cultural enrichment, and economic development for over 150 years. The University of Kentucky: - Facilitates learning, inf
Laureate Education, Inc.
For more than 20 years, we have remained committed to making a positive impact in the communities we serve, by providing accessible, high-quality undergraduate, graduate, and specialized degree programs. We know that when our students succeed, countries prosper, and societies benefit. We take very
George Mason University
George Mason University is Virginia’s largest and most diverse public research university. Located near Washington, D.C., Mason enrolls more than 40,000 students from 130 countries and 50 states, and has a residential population of more than 6,000 students. Mason has grown rapidly over the past half
University of Birmingham
Welcome to the official LinkedIn page for the University of Birmingham . We have been challenging and developing great minds for more than a century. Characterised by a tradition of innovation, research at the University has broken new ground, pushed forward the boundaries of knowledge and made an i
University of California, Davis
UC Davis was founded in 1908 to serve the state of California. We do and we always will. Today, that seed planted years ago has grown into one of the world’s top universities. UC Davis has a community of faculty and staff who are leading the way in teaching, research, public service and patient car
.png)
UU CyberSecurity News
October 23, 2025 07:00 AM
Utah State University Eastern New Faculty Spotlight: Simriti Koul
As part of USU Eastern's ongoing effort to introduce new faculty members to the campus community, this month's Faculty Spotlight features...
October 21, 2025 08:26 PM
Call for Proposals: Amazon Research Awards 2025
As the Amazon Research Awards (ARA) program continues to expand in scope, so does our call for proposals list. ARA will open the fall 2025 call for...
October 20, 2025 07:00 AM
Utah Valley University receives $35 million from Rich and Marla Linder
Utah Valley University receives $35 million from Rich and Marla Linder. The couple's gift, the largest in UVU history, will fund campuswide...
October 10, 2025 07:00 AM
Opinion: Utah can lead in securing America’s digital frontier
America's networks are under relentless attack, and Utah can show the rest of the country the way to a safer, more secure, tech-centered...
September 25, 2025 07:00 AM
Audit: Utah's K-12 and higher education systems could improve cybersecurity practices
A legislative audit released Thursday took a deeper look into Utah's cybersecurity practices for both public and higher education,...
September 25, 2025 07:00 AM
Audit: Utah K-12 schools and colleges remain at risk for cyberattacks
Legislative report suggests several steps Utah's K-12 districts and higher education institutions can take to boost cybersecurity.
September 10, 2025 07:00 AM
'Cybercrime isn't slowing down': Utah Tech University to host free cybersecurity seminar
The seminar, titled “Protecting Your Money in a Digital World,” is set to take place on Monday, Sept. 15, from 6 p.m. to 7:30 p.m. in room 121...
August 21, 2025 07:00 AM
High industry demand: Utah Tech expands its cybersecurity program offerings
Add Utah Tech University to the growing list of Utah schools expanding its cybersecurity offerings to meet the global demands of digital...
August 17, 2025 07:00 AM
'This stuff is moving so quickly': Utah Tech leaders discuss AI, unveil new cybersecurity degree
Utah Tech University spent part of Monday's Fall Academic Convocation discussing the evolving use of artificial intelligence and how best to...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
UU CyberSecurity History Information
Official Website of University of Utah
The official website of University of Utah is http://utah.edu.
University of Utah’s AI-Generated Cybersecurity Score
According to Rankiteo, University of Utah’s AI-generated cybersecurity score is 726, reflecting their Moderate security posture.
How many security badges does University of Utah’ have ?
According to Rankiteo, University of Utah currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does University of Utah have SOC 2 Type 1 certification ?
According to Rankiteo, University of Utah is not certified under SOC 2 Type 1.
Does University of Utah have SOC 2 Type 2 certification ?
According to Rankiteo, University of Utah does not hold a SOC 2 Type 2 certification.
Does University of Utah comply with GDPR ?
According to Rankiteo, University of Utah is not listed as GDPR compliant.
Does University of Utah have PCI DSS certification ?
According to Rankiteo, University of Utah does not currently maintain PCI DSS compliance.
Does University of Utah comply with HIPAA ?
According to Rankiteo, University of Utah is not compliant with HIPAA regulations.
Does University of Utah have ISO 27001 certification ?
According to Rankiteo,University of Utah is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of University of Utah
University of Utah operates primarily in the Higher Education industry.
Number of Employees at University of Utah
University of Utah employs approximately 11,323 people worldwide.
Subsidiaries Owned by University of Utah
University of Utah presently has no subsidiaries across any sectors.
University of Utah’s LinkedIn Followers
University of Utah’s official LinkedIn profile has approximately 265,203 followers.
NAICS Classification of University of Utah
University of Utah is classified under the NAICS code 6113, which corresponds to Colleges, Universities, and Professional Schools.
University of Utah’s Presence on Crunchbase
No, University of Utah does not have a profile on Crunchbase.
University of Utah’s Presence on LinkedIn
Yes, University of Utah maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/university-of-utah.
Cybersecurity Incidents Involving University of Utah
As of December 18, 2025, Rankiteo reports that University of Utah has experienced 2 cybersecurity incidents.
Number of Peer and Competitor Companies
University of Utah has an estimated 14,850 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at University of Utah ?
Incident Types: The types of cybersecurity incidents that have occurred include Ransomware and Breach.
What was the total financial impact of these incidents on University of Utah ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $457 thousand.
How does University of Utah detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with restoration from backup copies, and communication strategy with notified patients..
Incident Details
Can you provide details on each incident ?
Title: University of Utah Data Breach
Description: The University of Utah has paid around $457,000 after its College of Social and Behavioral Science servers were attacked by hackers. The attack impacted the data of both employees and students, but the IT services and systems were restored from backup copies.
Type: Data Breach
Threat Actor: Unknown hackers
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach UNI17568222
Financial Loss: $457,000
Data Compromised: Employee data, Student data
Systems Affected: College of Social and Behavioral Science servers
Incident : Data Breach UNI204613123
Data Compromised: Phi
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $228.50 thousand.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Employee Data, Student Data, and PHI.
Which entities were affected by each incident ?
Incident : Data Breach UNI17568222
Entity Name: University of Utah
Entity Type: Educational Institution
Industry: Education
Location: Utah, USA
Customers Affected: Employees, Students
Incident : Data Breach UNI204613123
Entity Name: University of Utah
Entity Type: Educational Institution
Industry: Education
Customers Affected: 10000
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach UNI17568222
Remediation Measures: Restoration from backup copies
Incident : Data Breach UNI204613123
Communication Strategy: Notified patients
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach UNI17568222
Type of Data Compromised: Employee data, Student data
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Restoration from backup copies, .
Investigation Status
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notified Patients.
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident was an Unknown hackers.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was $457,000.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Employee data, Student data, , PHI and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was College of Social and Behavioral Science servers.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Employee data, PHI and Student data.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 100.0.
.png)
Latest Global CVEs (Not Company-Specific)
Description
Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middleware is not properly applied to API endpoints. This results in certain API endpoints being accessible without valid session credentials. This is dangerous for those who have exposed Zerobyte to be used outside of their internal network. A fix has been applied in both version 0.19.0 and 0.18.5. If immediate upgrade is not possible, restrict network access to the Zerobyte instance to trusted networks only using firewall rules or network segmentation. This is only a temporary mitigation; upgrading is strongly recommended.
Risk Information
cvss3
Base: 9.1
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's filter configuration. The CSRF protection mechanism was **explicitly disabled**, allowing the application to process state-changing requests (POST) without verifying a valid CSRF token. An unauthenticated remote attacker can exploit this by hosting a malicious web page. If a logged-in administrator visits this page, their browser is forced to send unauthorized requests to the application. A successful exploit allows the attacker to silently create a new Administrator account with full privileges, leading to a complete takeover of the system and loss of confidentiality, integrity, and availability. The vulnerability has been patched in version 3.4.2. The fix re-enables the CSRF filter in `app/Config/Filters.php` and resolves associated AJAX race conditions by adjusting token regeneration settings. As a workaround, administrators can manually re-enable the CSRF filter in `app/Config/Filters.php` by uncommenting the protection line. However, this is not recommended without applying the full patch, as it may cause functionality breakage in the Sales module due to token synchronization issues.
Risk Information
cvss3
Base: 8.8
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/Nixon-H/CVE-2025-68434-OSPOS-CSRF-Unauthorized-Administrator-Creation
- https://github.com/opensourcepos/opensourcepos/commit/d575c8da9a1d7af8313a1e758e000e243f5614ef
- https://github.com/opensourcepos/opensourcepos/pull/4349
- https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-wjm4-hfwg-5w5r
Description
Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Model Context Protocol (MCP) configurations from the `settings.json` file located within a project’s `.zed` subdirectory. A malicious MCP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered automatically without any user interaction besides opening the project in the IDE. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (`./zed/settings.json`) before opening new projects in Zed.
Risk Information
cvss3
Base: 7.7
Severity: HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Language Server Protocol (LSP) configurations from the `settings.json` file located within a project’s `.zed` subdirectory. A malicious LSP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered when a user opens project file for which there is an LSP entry. A concerted effort by an attacker to seed a project settings file (`./zed/settings.json`) with malicious language server configurations could result in arbitrary code execution with the user's privileges if the user opens the project in Zed without reviewing the contents. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (`./zed/settings.json`) before opening new projects in Zed.
Risk Information
cvss3
Base: 7.7
Severity: HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e. run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) and publish the built Storybook to the web. Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users should upgrade their Storybook—on both their local machines and CI environment—to version .6.21, 8.6.15, 9.1.17, or 10.1.10 as soon as possible. Maintainers additionally recommend that users audit for any sensitive secrets provided via `.env` files and rotate those keys. Some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, either prefix the variables with `STORYBOOK_` or use the `env` property in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.
Risk Information
cvss3
Base: 7.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=university-of-utah' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
