At least two California universities were among an estimated 300 educational, governmental, and financial institutions nationwide that were hacked in a massive cyberattack in December and January.
The University of California is warning its students, staff and retirees that their personal data – including name, date of birth, Social Security number, and financial information may have been stolen.
The Stanford University School of Medicine also confirmed that it was a victim of the cyberattack.
Hackers reportedly targeted a vulnerability in Accellion, a third-party vendor used to transfer secure files, and have threatened to publish the stolen data on the dark web.
“We understand those behind this attack have published online screenshots of personal information, and we will notify members of the UC community if we believe their data was leaked in this manner," the University of California said in a statement.
The university is offering free credit monitoring and protection against identity theft to those whose personal data may have been compromised.
In some instances, the hackers have demanded money from the institutions in return for not publishing the data.