Hospitals, health insurance companies, and universities have all become a frequent target for hackers seeking massive databases of personal information. Profile data, Social Security numbers and health records sell quickly on the black market and are now more profitable in that marketplace than is credit card information. Illegal data brokers amass large databases of this stolen information, then sell access to identity thieves.

An now hackers reportedly broke into the massive hospital network of the University of California, Los Angeles, accessing computers with sensitive records of 4.5 million people. According to the story on Fox2Now, names, medical information, Social Security numbers, Medicare numbers, health plan IDs, birthdays and physical addresses – all were potentially stolen. That could affect anyone who has visited – or works – at the university’s medical network, UCLA Health, which includes four hospitals and 150 offices across Southern California. UCLA Health made this announcement on Friday – two months after it discovered the extent of the data breach.

Evidence collected by UCLA Health indicates hackers slipped into computers in September 2014. The next month, university network alarms “detected suspicious activity,” and UCLA Health called in the FBI for help. “At that time, it did not appear that the attackers had gained access to the parts of the network that contain personal and medical information,” UCLA Health said in a statement.

That changed on May 5, when UCLA claims it discovered hackers actually accessed computers with sensitive records. The hospital group is now notifying staff and patients, offering them one year of identity theft recovery services. However, UCLA Health stresses it can’t yet be sure that hackers actually accessed – or stole – the records themselves. The FBI is currently trying to determine “the nature and scope” of the incident.

The UCLA Hospital System’s president, Dr. James Atkinson, apologized to the public in a statement. The hospital group also noted it is under “near-constant attack” by hackers – blocking “millions of known hacker attempts each year.” UCLA Health said the hack forced it to employ more cybersecurity experts on its internal security team, and to hire an outside cybersecurity firm to guard its network.

Health care tends to lose larger numbers of records. When insurance giant Anthem was hacked, up to 80 million records were stolen. The Premera health insurance hack hit 11 million people. Hackers also stole data on 4.5 million Community Health System patients.

Universities get slammed as well. Last year, hackers stole 310,000 University of Maryland records. This year, Auburn University exposed its students’ Social Security numbers. North Dakota University, Butler University, and Indiana University have all exposed the private information of hundreds of thousands of students.