Inside a ransomware attack at University of California at San Francisco as it rushes to research a COVID-19 vaccine, leading to a 116 bitcoin (~$1.14M) payment
Kartikay Mehrotra / Bloomberg :
Context & Ripple Effects
UCSF's payment lands on a ransomware curve that has been steepening for years: Hollywood Presbyterian's $17K hospital ransom in 2016 was followed by Google's $25M tally of victim payments and 2019 research showing average demands climbing past $84K by year-end. The University of California system has been a repeat target — Berkeley's breach of its financial software hit 80K people — so this is an institution paying under a second known attack on the same system.
What makes the UCSF case a marker is the victim's leverage: the university was mid-race on COVID-19 vaccine research, the exact time-critical, high-value work that makes downtime intolerable and a seven-figure payment rational. The 116-bitcoin payout (~$1.14M) is roughly an order of magnitude above the 2019 average and points toward the trajectory later confirmed by the record $75M Cencora ransom in drug distribution.
First-order effects
- UCSF regains access to systems holding vaccine research data at the cost of ~$1.14M in bitcoin, while the attackers convert a healthcare-research victim into proof that seven-figure demands are payable.
- The University of California now has two documented intrusions — Berkeley's financial software breach and UCSF's ransomware hit — forcing system-wide scrutiny of how research and administrative networks are segmented.
Second-order effects
- Hospitals, universities, and drug distributors watching this payment learn that time-critical science and medicine reliably pay, which prices future demands upward and concentrates attacker targeting on exactly those sectors.
- Insurers and university counsel face pressure to pre-authorize ransom budgets for research continuity, shifting negotiation from ad-hoc crisis response to a priced-in operating cost.
Third-order effects
- If the pattern holds — $17K in 2016, ~$84K averages by late 2019, $1.14M here, a record $75M by 2024 — ransomware becomes a structural tax on high-stakes knowledge work, with the largest payouts migrating toward pharma and healthcare data holders.
- Sustained payments without prosecution push the burden toward regulators and research funders to mandate segmentation, offline backups, and disclosure rules for publicly funded labs, since bitcoin ransoms have proven an ineffective deterrent.
The trend: Ransomware demands are escalating from nuisance-scale to seven- and eight-figure sums as attackers learn that hospitals, universities, and drug distributors with time-critical, irreplaceable data will pay.