14 DAY TRIAL // University of California Berkeley (UCB) said today in a statement that someone has gained unauthorized access to the personal and financial details of over 80,000 current and former faculty, staff, students and business partners.
UCB's IT staff detected the data breach last December. Officials called in a cyber-security firm to aid during their investigation, and only managed to compile a complete list of affected individuals on February 25.
Today, the University started sending out letters to all affected individuals, and also publicly announced the data breach. Officials also notified the FBI about the cyber-attack.
Attackers exploit a vulnerability in UCB's payments system
UCB staff says that the attackers gained access to some of the computers that are part of the Berkeley Financial System (BFS), an application that UCB uses to handle various financial transactions.
As Berkeley officials explain, the intrusion took place via a vulnerability which the university's staff was in the process of patching.
Attackers got access to the details of over 57,000 current and former students, 18,800 former and current employees (including student workers) and 10,300 business partners. Some individuals are part of multiple affected categories, but the total racks up a little over 80,000.
These numbers represent around 50% of UCB's current total student numbers, and around 65% of its current active employees.
Attackers got access to SSNs and bank account numbers
Leaked data includes SSNs (Social Security Numbers) and bank account numbers. UCB says this data was stored on their system because it was needed to make payments to the affected parties.
Berkeley has offered one year of free credit protection for all affected individuals.
At the beginning of the month, another US university, the University of Central Florida also suffered a data breach during which it exposed the details of over 63,000 staff and faculty members and current and former students.