They outsourced some IT staff. Reports are that this attack hit the epidemiology department, which lists a 10-person IT staff: https://epibiostat.ucsf.edu/our-

They outsourced some IT staff. Reports are that this attack hit the epidemiology department, which lists a 10-person IT staff: https://epibiostat.ucsf.edu/our-team https://epibiostat.ucsf.edu/our-team I don't think we can assume that the IT outsourcing directly affected their vulnerability to this attack.