University of California
Disclosed May 13, 20215 years ago547,422 accountsConfirmed
In December 2020, the University of California suffered a data breach due to vulnerability in in a third-party provider, Accellion . The breach exposed extensive personal data on both students and staff including 547 thousand unique email addresses, names, dates of birth, genders, social security numbers, ethnicities and other academic related data attributes. Further analysis is available in Exploring the Impact of the UC Data Breach . The data was provided to HIBP courtesy of Cyril Gorlla.
What is known
| People affected | 547,422 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | May 13, 2021 |
| Happened | Dec 24, 2020 |
| Attack | Supply chain |
| Data exposed | Dates of birth, Education records, Emails, Employment, Names, Phone numbers, Addresses, Government IDs |
| Sector | Education · US |
| Status | Confirmed |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: University of Californiaoag.ca.gov · Official notice | Official notice |
| Have I Been Pwned: University of Californiahaveibeenpwned.com · Aggregator | Aggregator |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | May 13, 2021 | |
| Have I Been Pwnedaccounts in the data | Jun 20, 2021 | 547,422 |
History of this record
- 2026-09-25 · hibp: empty to UC · backfill source
- 2026-09-25 · attack: unknown to supply-chain · backfill source
- 2026-09-25 · data_types: [] to ["dob","education","emails","employment","names","phone","addresses","government-id"] · backfill source
- 2026-09-25 · records_basis: empty to hibp · backfill source
- 2026-09-25 · records: empty to 547422 · backfill source
- 2026-09-25 · summary: empty to In December 2020, the University of California suffered a data breach due to vulnerability in in a third-party provider, Accellion . The breach exposed extensive personal data on both students and staff including 547 thousand unique email a · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.