UCSF reportedly paid $1.14 million to hackers in June 2020 as a ransom payment—but there might have been a second transfer.