The Pennsylvania State Education Association (PSEA) is notifying over 500,000 individuals that their personal information was compromised in a July 2024 data breach
In a breach notice posted on its website, the teachers' union confirmed that the security incident occurred around July 6, affecting its network environment and resulting in the theft of sensitive data.
On February 18, 2025, PSEA determined that the stolen files contained personal information and has since begun notifying affected individuals in writing.
The compromised data includes names, dates of birth, driver's license and state ID details, passport numbers, Social Security numbers, account credentials, payment card information, taxpayer ID numbers, and health insurance and medical details.
"We have no evidence that any of the information has been used for identity theft or to commit financial fraud. Nevertheless, out of an abundance of caution, we want to make the impacted individuals aware of the incident," the union stated.
PSEA has also informed the Maine Attorney General’s Office that 517,487 individuals were affected and that they will be offered one year of free credit monitoring and identity restoration services.
While the union did not disclose the nature of the attack, it mentioned taking steps to ensure the stolen data was deleted, which suggests a ransomware attack may have been involved.
The Rhysida ransomware gang claimed responsibility for the attack in September 2024, adding PSEA to its Tor-based leak site and threatening to auction the stolen data unless a ransom was paid. The group demanded 20 Bitcoin for the allegedly stolen information.
