Cyber Incident Victim: University of California, Berkeley
Date:
Dec 2015
Location:
United States of America
Summary
The University of California, Berkeley experienced a cyberattack exploiting a vulnerability in its financial management system, potentially exposing sensitive personal information—including Social Security and bank account numbers—belonging to approximately 80,000 individuals, primarily current and former students, employees, and vendors. While no evidence confirmed data theft, the institution notified law enforcement, alerted affected parties about potential misuse risks, and offered free credit monitoring. This marked the second such incident in recent years, following a prior breach that compromised data from roughly 1,600 individuals.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In late December 2015, attackers exploited a security flaw in the Berkeley Financial System (BFS), a financial management platform used by the University of California, Berkeley for processing purchases and non-salary payments. The breach allowed unauthorized access to internal university services containing sensitive personal information. The compromised system stored Social Security numbers and bank account details for approximately 80,000 individuals, including 57,000 current and former students (with student workers comprising part of this group) and 10,300 vendors. University officials estimated that roughly 50% of current students and 65% of active employees had their information potentially exposed. While forensic analysis found no conclusive evidence that data was actually exfiltrated or misused, the vulnerability window existed during the period when security patches were being applied to the BFS platform.
The university publicly disclosed the incident in February 2016, notifying the FBI and other law enforcement agencies. Chief Information Security Officer Paul Rivers acknowledged the breach in an official statement, emphasizing institutional regret and confirming implementation of additional safeguards to protect personal information. Affected individuals received warnings about potential identity theft risks and were offered free credit monitoring services. This marked UC Berkeley's second significant cybersecurity incident within fourteen months, following a December 2014 breach targeting the Real Estate Division that exposed data belonging to approximately 1,600 people. The 2015 attack specifically impacted financial operations rather than academic or research systems, with vendor payment information joining student and employee data in the pool of potentially compromised records.