Cyber Incident Victim: University of California Merced
Date:
Mar 2021
Location:
United States of America
Summary
The University of California Merced was targeted in a ransomware attack by the Clop group, which employed double-extortion tactics involving data theft and threats of public leaks. Compromised information included sensitive personal and financial records such as Social Security numbers, retirement documents, health savings plan enrollments, benefit requests, addresses, immigration statuses, and birth dates. The incident mirrored broader attacks on educational institutions exploiting vulnerabilities in third-party file transfer systems, with leaked data exposing individuals to potential identity theft and financial fraud.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 29, 2021, the Clop ransomware group published screenshots of stolen data allegedly belonging to the University of California, Merced, and the University of Maryland. The leaked records included federal tax documents, tuition remission paperwork, nursing board applications, passports, and tax summaries. Specific data types exposed encompassed names, addresses, Social Security numbers, immigration statuses, and birth dates. For UC Merced, compromised information involved Social Security numbers, retirement documents, 2019 and 2020 benefit requests, and health savings plan enrollments. The attackers executed a double-extortion strategy by first deploying ransomware and then threatening to release exfiltrated data unless ransom demands were met. This incident formed part of a broader campaign targeting educational institutions, as Clop had previously leaked data from the University of Miami and the University of Colorado earlier in March 2021.
The breach at the University of Maryland, College Park, was confirmed to have originated from a December 2020 compromise of its Accellion File Transfer Appliance (FTA) server, impacting files containing personal data of students, faculty, and staff. The university initiated credit monitoring services for affected individuals and notified law enforcement agencies. Forensic investigations determined no additional system compromises occurred after March 29. Clop’s activities extended beyond academia, with the group leaking financial data from technology firm Acer after a $50 million ransom demand and energy company Shell reporting a related Accellion FTA breach. The University of Maryland clarified that leaked files pertained specifically to its Baltimore campus operations rather than the separate University of Maryland, Baltimore institution.