University of California Data Breach Exposes 547,422 Personal Records via Accellion Vendor Vulnerability
What Happened – In December 2020 a vulnerability in Accellion’s third‑party file‑transfer service, used by the University of California, was exploited. Attackers accessed and extracted 547 k records containing names, email addresses, dates of birth, Social Security numbers, ethnicities, genders, job titles, phone numbers, and physical addresses of students and staff.
Why It Matters for Trust & Control Assurance
- The incident is a textbook case of a supply‑chain control gap: inadequate oversight of a critical SaaS provider created a blind spot in the university’s control‑assurance program.
- Continuous third‑party monitoring and documented due‑diligence are essential to provide a defensible audit trail and to satisfy control objectives that map across frameworks such as NIST CSF 2.0.
- Leveraging a dedicated vendor‑risk capability helps organizations collect real‑time evidence of provider security posture, reducing exposure to similar breaches.
Who Is Affected – Higher‑education institutions; students, faculty, and staff whose personal data were stored in university systems.
Recommended Actions
- Initiate a comprehensive third‑party risk assessment of all SaaS and file‑transfer providers.
- Deploy continuous security monitoring of vendor controls and retain evidence for audit readiness.
- Update incident‑response playbooks to include vendor‑originated threat scenarios and test them regularly.
Source: Have I Been Pwned – UC breach details
Technical Notes – The breach stemmed from a known vulnerability in Accellion’s legacy file‑transfer appliance (CVE‑2020‑XXXX). Exploited via remote code execution, the flaw allowed attackers to retrieve stored files containing the exposed data. No ransomware or extortion was reported.