Cyber Incident Victim: University of California, Davis
Date:
Jun 2020
Location:
United States of America
Summary
The University of California, Davis was targeted by a racist cyberattack involving emails sent to thousands of accounts, falsely appearing to originate from Atlanta-based Equity Prime Mortgage. The messages contained racial slurs, promoted a whites-only lending policy, and referenced lynching, prompting the institution to block most emails and collaborate with the FBI. Similar attacks affected at least five other universities, including Harvard and Stanford, while Equity Prime—also identified as a victim—worked with authorities to investigate the source. The university characterized the incident as abusive and violent, pledging to enhance security measures against future malicious assaults.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around June 20-21, 2020, the University of California, Davis, experienced a racially motivated cyberattack involving mass-distributed malicious emails. Thousands of UC Davis email accounts received messages disguised as mortgage pre-qualification confirmations from Atlanta-based Equity Prime Mortgage. The emails contained explicit racist content, including the statement "a lender for whites only. That’s how we have such low rates!," accompanied by a racial slur and a reference to lynching. University cybersecurity systems intercepted and blocked the majority of these messages before widespread delivery. UC Davis officials publicly confirmed the incident on June 23, characterizing the messages as "racist, abusive and violent." The attack formed part of a broader campaign targeting at least five other major U.S. universities: Harvard, Stanford, Columbia, Michigan, and Iowa State.
UC Davis Chief Information Security Officer Cheryl Washington immediately reported the incident to the FBI and initiated internal reviews to strengthen email filtering protocols. The university characterized the event as a malicious assault requiring coordinated law enforcement response. Forensic analysis revealed Equity Prime Mortgage was itself compromised, with attackers exploiting the lender's systems to launch the campaign. The mortgage company collaborated with federal investigators to trace the attack origin. While UC Davis successfully prevented most messages from reaching inboxes, the incident exposed vulnerabilities in academic email systems to socially engineered hate content. No data breaches or network compromises beyond the email campaign were reported by UC Davis. The coordinated targeting of multiple institutions suggested a deliberate attempt to amplify racial division during nationwide social justice protests occurring contemporaneously.