According to recent disclosures from the UC San Diego Health System, the institution has experienced a significant data breach. UC San Diego Health is one of the top hospitals in the United States, serving as the primary health center for the MLB’s San Diego Padres and other high-profile clients. The data breach was discussed in detail on a dedicated page on the institution’s website entitled “Data Security FAQs.” The explanation of the incident and how the organization responded is found in the following excerpt from this page:
When UC San Diego Health discovered the issue, we terminated the unauthorized access to these accounts and enhanced our security controls. UC San Diego Health reported the event to the FBI and is working with external cybersecurity experts to investigate the event and determine what happened, what data was impacted, and to whom the data belonged. This process of analyzing the data in the email accounts is ongoing. UC San Diego Health is moving as quickly as possible while taking the care and time to deliver accurate information about which data was impacted. At this time, we are aware that these email accounts contained personal information associated with a subset of our patient, student, and employee community. We estimate this review will be complete in September.
According to UCSDH, there are no known instances of this personal data being used by threat actors. Additionally, there is no current evidence suggesting that any other university systems were penetrated during the attack. As is the case with incidents like this, the fallout tends to not be known until many months after the fact. This is why UCSDH is giving anyone potentially affected by the breach credit monitoring and access to identity protection services. Anyone who had data in the university system between Dec. 2, 2020, and April 8, 2021 (the time period over which the breach occurred) should pay close attention to their accounts.
When reporting on the data breach, Bleeping Computer noted that the root cause of this incident was a phishing attack. The news organization was able to obtain this information via UC San Diego Health’s Executive Director of Communications and Media Relations Jacqueline Carr. In a correspondence with Bleeping Computer, Carr disclosed this fact.
Featured image: Wikimedia Commons / Coolcaesar
