Yes, It Is April 1 - But This Is Real

From an email circulated last night:

Dear Bruin Community:

I wanted to make you aware of a cyber security incident that may have impacted members of our community and provide you with information and resources to help anyone who might have been affected. Please know that UCLA is committed to the security of your personal information and is working to address this.

Beginning this past Monday, many UCLA email accounts started receiving messages stating that their personal data had been stolen and would be released. These emails contained a link to a public website where a sample of personal information from UC employees was posted.

We learned from UCOP that some personal data for UC employees was in fact obtained through a cyber-attack on a UCOP system, and this is believed to be the source of the personal information release that was referenced. The security team at UCOP is investigating this attack and I encourage you to read their message about it on UCnet.*

We are working with UCOP to determine the scope and will reach out directly to any members of the UCLA community affected by this incident. In the meantime, if you receive any suspicious email, please report it to us via security@ucla.edu without clicking on any links or replying to the sender.

For additional recommendations and best practices please visit our IT Security website.

Sincerely,

David Shaw

UCLA Chief Information Security Officer

====

*UCOP message below:

UC part of nationwide cyber attack

Wednesday, March 31, 2021

UC has learned that it, along with other universities, government agencies, and private companies throughout the country, was recently subject to a cybersecurity attack. The attack involves the use of Accellion, a vendor used by many organizations for secure file transfer, in which an unauthorized individual appears to have copied and transferred UC files by exploiting a vulnerability in Accellion’s file transfer service.

UC’s investigation includes a review of the files we believe may have been copied and transferred as part of this attack. Upon completion of our review, we should be able to better assess the data and individuals impacted. Once we can identify affected individuals, we will notify them and provide information regarding additional next steps. 

We understand those behind this attack have published online screenshots of personal information, and we will notify members of the UC community if we believe their data was leaked in this manner.

Watch out for suspicious emails

We believe the person(s) behind this attack are sending threatening mass emails to members of the UC community in an attempt to scare people into giving them money. The message states:

“Your personal data has been stolen and will be published”

By their nature, these kinds of attacks are very broad and somewhat imprecise. Accordingly, some UC community members receiving these threatening emails will not have had their data compromised, while other community members with compromised data may not receive any email.

Anyone receiving this message should either forward it to your local information security office or simply delete it.

Important reminders about protecting yourself, and UC

We remind all members of the UC community to not click on links or open attachments unless you know and trust the sender.

In addition, you may wish to take the following steps to protect your information:

• Consider taking additional identity theft measures described at https://www.identitytheft.gov/databreach
• Place a fraud alert with one of the three nationwide credit bureaus:
  • https://www.equifax.com/personal/
  • https://www.transunion.com
  • https://www.experian.com/
• Place a security freeze on your credit report by making a request to the three credit bureaus. 

UC regards the privacy of all its community members with the utmost seriousness. We will update the UC community as we are able to disclose additional information.

Source: https://ucnet.universityofcalifornia.edu/news/2021/03/uc-part-of-nationwide-cyber-attack.html