More on the Cyberattack

From an email circulated yesterday evening:

To the University of California Community:

We are writing to provide you additional information about a data security incident affecting the UC community and what you should do to protect your personal information.

As was announced on March 31st, UC is one of several institutions targeted by a nationwide cyber attack on Accellion’s File Transfer Appliance (FTA), a vendor service used for transferring sensitive information. This attack has affected approximately 300 organizations, including universities, government institutions and private companies. In this incident the perpetrators gained access to files and confidential personal information by exploiting a vulnerability in Accellion’s program. At this time, we believe the stolen information includes but is not limited to names, birth dates, Social Security numbers and bank account information. The attackers are threatening to publish, or have published, stolen information on the dark web in an attempt to extort organizations and individuals.

We are working with local and federal law enforcement and third-party vendors to investigate this incident, to assess the information that has been compromised, to enforce the law, and to limit the release of stolen information.

We are alerting you now so you are able to take protective actions as we work to address the situation.

What you should do to protect your personal and financial information:

• Sign up for free credit monitoring and identity theft protection: To help you protect your identity, we are offering the entire UC community complimentary credit monitoring and identity theft protection for one year through Experian IdentityWorksSM. This service includes:
   
  • Credit monitoring: Actively monitors your Experian file for indicators of fraud.
  • Internet surveillance: Technology searches the web, chat rooms & bulletin boards 24/7 to identify trading or selling of your personal information on the dark web.
  • Identity restoration: Identity restoration specialists are immediately available to help you address credit and non-credit related fraud.
  • Experian IdentityWorks ExtendCARETM: You receive the same high-level of identity restoration support even after your Experian IdentityWorks membership has expired.
  • $1 Million Identity Theft Insurance: Provides coverage for certain costs and unauthorized electronic fund transfers.
  • Lost wallet: Provides assistance with canceling/replacing lost or stolen credit, debit, and medical cards.
  • Child monitoring: For 10 children up to 18 years old, internet surveillance and monitoring to determine whether enrolled minors in your household have an Experian credit report are available. Also included are identity restoration and up to $1M Identity Theft Insurance.
  Sign up at the Experian IdentityWorks website using the enrollment code [omitted]:*
  • For adults
  • For minors
  For help with enrolling, you may call (866) 617-1923 and reference engagement number [omitted].*

• Monitor and set up alerts for bank account(s): Monitor your bank account(s) for suspicious transactions and report any to your bank. Ask the bank for online monitoring and alerts on your account. This will give you early warning of any fraudulent transactions.

• Watch out for suspicious emails: We believe the person(s) behind the Accellion FTA attack may send threatening mass emails in an attempt to scare people into giving them money. Anyone receiving such an email should either forward it to your local information security office or simply delete it. Please do not engage or respond.

• Place a fraud alert on your credit file: We recommend you place a fraud alert on your credit file by contacting one of the three nationwide credit bureaus listed below. If a fraud alert is placed on a consumer’s credit file, certain identity verification steps must be taken prior to extending new credit.
   
  • Equifax
  • TransUnion
  • Experian

• Important reminders about protecting yourself: These incidents are reminders of the importance of doing everything possible to protect your online information. Here are five rules for protecting your information. In addition, you may wish to take additional identity theft measures described at Federal Trade Commission Identity Theft site.

We regard the privacy of all of our community members with the utmost seriousness. We will keep the UC community updated as we learn more and are able to share additional information.

==========

NOTE: After an earlier loss of confidential data affecting UCLA many years ago, yours truly froze access to his credit with the three credit-rating companies listed above. Essentially, no one can do such things as obtain a credit card, car loan, mortgage, etc., once you freeze your account. The downside is that you can't do those things either without a hassle - and some expense - of temporarily unfreezing your account.

==========

*If you think you are entitled to this code, get in touch with your UCLA department.

==========

UPDATE: ...The Baltimore Sun on Thursday reported that private information of staff members and students at the University of Maryland, Baltimore, was posted online this week. The school said a hacking group known as Clop gained access to Accellion in December, the Sun reported...

Source: https://www.latimes.com/world-nation/story/2021-04-02/university-of-california-victim-of-nationwide-hack-attack.

UCLA History: Who is Gene?

The photo caption tells us we are looking at "Gene" as the Westwood campus is being constructed on August 21, 1929. But who is Gene?

Source: https://dl.library.ucla.edu/islandora/object/universityarchives%3A26447

The Alternative Way to Read the Blog: First Quarter 2021

At the end of each quarter (calendar quarter, not UCLA quarter), we offer that quarter's blog posts as a book which can be read online and/or downloaded. Of course, as a book, there are no audios, videos, or animated gifts. The conversion to a book also causes some odd formatting. Two links are below:

Read only: https://issuu.com/danieljbmitchell/docs/ucla_faculty_association_blog__first_quarter_2021

Read and/or download: https://archive.org/details/ucla-faculty-association-blog-first-quarter-2021

Phony IRS Scam Aimed at .EDU

From Inside Higher Ed:

IRS Warns of Scam Targeting .Edu Email Addresses

April 1, 2021

The Internal Revenue Service is warning about a tax refund scam from IRS impersonators who are targeting those who work at colleges and universities, as well as their students.

People with email addresses ending in .edu have been reporting email phishing attempts in recent weeks. The attempts appear to target staff members and students at all types of institutions -- public, private, nonprofit and for-profit.

Emails display the IRS logo and feature subject lines like “Tax Refund Payment” and "Recalculation of your tax refund payment." They ask recipients to click a link and submit a form that includes sensitive information.

Those receiving such messages should not click on the links in the messages, according to the IRS.

The IRS published a set of instructions for sending copies of the phishing emails to authorities. Those instructions also cover what to do for those whose tax returns are rejected because someone has already filed a return with their Social Security number.

Anyone who thinks they might have provided information to identity thieves as part of this phishing attempt can also opt in to a voluntary PIN program that can help stop thieves from filing fraudulent tax returns.

The phishing attempts are seeking the following information:

• Social Security number
• First name
• Last name
• Date of birth
• Prior year annual gross income (AGI)
• Driver's license number
• Current address
• City
• State/U.S. territory
• ZIP code/postal code
• Electronic filing PIN
• ===
• Source: https://www.insidehighered.com/quicktakes/2021/04/01/irs-warns-scam-targeting-edu-email-addresses

Make it Unofficial

We have noted from time to time that student government actions are seen by the outside public as official actions of the university. Student government is supported by mandated fees collected by the university, a collection activity that reinforces the notion that what student government does represents the official position of the university. A greater separation of the university and the student government is needed. 

In that spirit, we note the editorial below from the UCLA Daily Bruin concerning a recent controversial action of student government. Below that editorial is a link to a statement at the most recent Regents meeting by the student representative.

Editorial: Controversial USAC divestment resolution reflects importance of transparency

By Daily Bruin Editorial Board, 3-29-21

Transparency promotes accountability. It’s a sentiment that’s often shared by both members of the Undergraduate Students Association Council and its critics. Most recently, various Jewish and pro-Israel student organizations raised concerns about USAC’s transparency following the council’s approval of a resolution that called for the University of California to divest from businesses that contribute to global military operations. The text of the resolution was not made available before the council meeting.

Included in the demands was a specific call to divest from the “ethnic cleansing in Palestine by the Israeli government.” Student organizations said it was impossible for them to share their opinions before the council voted, as there was no way they could have known in advance the resolution would contain what they thought to be unfair language. Some officials said they didn’t realize the language of the resolution was controversial until after it had been passed.

The council could have benefitted from a more diverse set of opinions since the very start. Now that the resolution has been passed, there is no way of knowing if a larger range of student voices might have changed the council’s opinion.

At least USAC responded to the controversy in stride. USAC Internal Vice President Emily Luong proposed a bylaw amendment that would require the council to make details of resolutions public two days before future USAC meetings, and the council approved the measure at its following meeting. Such measures to increase transparency should prevent a similar situation from happening in the future, and the board supports Luong in her effort to do so.

Still, nothing can change the fact that student officials passed the resolution while many students were left in the dark. What’s even more concerning is that USAC has shown no interest in reopening the resolution for discussion. The passed resolution may not enact anything concrete, but its language sends a message to the administration, the student body and the world. When it comes to deeply personal, controversial issues such as this, a student government is obligated to put in a good faith effort to hear all parts of the student body before making decisions.

Moving forward, the council should not shy away from dealing with contentious topics, as open discussions can be productive and informative when done correctly. But when one argument is all but eliminated, a discussion becomes a one-sided debate and that productivity is lost.

For a student government, setting this kind of precedent is dangerous.

Source: https://dailybruin.com/2021/03/29/editorial-controversial-usac-divestment-resolution-reflects-importance-of-transparency

===

Statement to the Regents by the student representative calling for opt-in (not opt-out or mandatory) student fees:

Or direct to https://www.youtube.com/watch?v=lyJ33TEFOXM.

New Claims Data: Stuck on a Plateau

As blog readers will know, we have followed the data on new weekly claims for unemployment insurance benefits in California to monitor the state of the labor market and as an index of economic trends. 

We expressed hope in last Thursday's release that the data would continue to show a downward trend. But the most recent data for the week ending March 27 instead shows an upward bump. We seem, in short to be on a plateau. Our weekly chart is below:

The latest data are (always) at https://www.dol.gov/ui/data.pdf.

Yes, It Is April 1 - But This Is Real

From an email circulated last night:

Dear Bruin Community:

I wanted to make you aware of a cyber security incident that may have impacted members of our community and provide you with information and resources to help anyone who might have been affected. Please know that UCLA is committed to the security of your personal information and is working to address this.

Beginning this past Monday, many UCLA email accounts started receiving messages stating that their personal data had been stolen and would be released. These emails contained a link to a public website where a sample of personal information from UC employees was posted.

We learned from UCOP that some personal data for UC employees was in fact obtained through a cyber-attack on a UCOP system, and this is believed to be the source of the personal information release that was referenced. The security team at UCOP is investigating this attack and I encourage you to read their message about it on UCnet.*

We are working with UCOP to determine the scope and will reach out directly to any members of the UCLA community affected by this incident. In the meantime, if you receive any suspicious email, please report it to us via security@ucla.edu without clicking on any links or replying to the sender.

For additional recommendations and best practices please visit our IT Security website.

Sincerely,

David Shaw

UCLA Chief Information Security Officer

====

*UCOP message below:

UC part of nationwide cyber attack

Wednesday, March 31, 2021

UC has learned that it, along with other universities, government agencies, and private companies throughout the country, was recently subject to a cybersecurity attack. The attack involves the use of Accellion, a vendor used by many organizations for secure file transfer, in which an unauthorized individual appears to have copied and transferred UC files by exploiting a vulnerability in Accellion’s file transfer service.

UC’s investigation includes a review of the files we believe may have been copied and transferred as part of this attack. Upon completion of our review, we should be able to better assess the data and individuals impacted. Once we can identify affected individuals, we will notify them and provide information regarding additional next steps. 

We understand those behind this attack have published online screenshots of personal information, and we will notify members of the UC community if we believe their data was leaked in this manner.

Watch out for suspicious emails

We believe the person(s) behind this attack are sending threatening mass emails to members of the UC community in an attempt to scare people into giving them money. The message states:

“Your personal data has been stolen and will be published”

By their nature, these kinds of attacks are very broad and somewhat imprecise. Accordingly, some UC community members receiving these threatening emails will not have had their data compromised, while other community members with compromised data may not receive any email.

Anyone receiving this message should either forward it to your local information security office or simply delete it.

Important reminders about protecting yourself, and UC

We remind all members of the UC community to not click on links or open attachments unless you know and trust the sender.

In addition, you may wish to take the following steps to protect your information:

• Consider taking additional identity theft measures described at https://www.identitytheft.gov/databreach
• Place a fraud alert with one of the three nationwide credit bureaus:
  • https://www.equifax.com/personal/
  • https://www.transunion.com
  • https://www.experian.com/
• Place a security freeze on your credit report by making a request to the three credit bureaus. 

UC regards the privacy of all its community members with the utmost seriousness. We will update the UC community as we are able to disclose additional information.

Source: https://ucnet.universityofcalifornia.edu/news/2021/03/uc-part-of-nationwide-cyber-attack.html