Illustration: Supimol Kumying | Shutterstock
The Pennsylvania State Education Association (PSEA) has revealed a data breach from its website that leaked the personal information of 517,487 users. The union has started sending written notifications to potentially affected individuals.
The organisation confirmed the breach in a notice, claiming the incident occurred around July 6, 2024, and targeted its network environment, with attackers extracting information after the breach.
It took the union until February 18, 2025, to figure out that the stolen files included personal information, including names, birthdays, driver’s license and state ID details, Social Security Numbers, financial account information and credentials (including payment card number, PIN, and expiration date), taxpayer ID numbers, passport numbers, and any health insurance and medical information saved on the portal.
No details on the nature of the attack were shared. The PSEA has ensured victims that the data taken by the hackers was deleted, possibly indicating that this was a ransomware attack and a ransom was paid. SecurityWeek reports that the Rhysida ransomware gang claimed responsibility for the attack in September 2024 and added PSEA to its dark web leak site. The group demanded 20 Bitcoin to delete the stolen information, threatening to peak the data if the ransom wasn’t paid publicly.
PSEA didn’t share anything about a ransomware attack, so it’s unclear whether they paid the full ransom, part of it, or got the data deleted by some other method. Regardless, their notice claims that the union took steps “to the best of our ability and knowledge, to ensure that the data taken by the unauthorised actor was deleted.”
There is no evidence that the leaked information has been used for identity theft or fraud. Regardless, all affected individuals are getting one year of free credit monitoring and identity restoration services “out of an abundance of caution.”
In the News: Over 25 celebs booked in India for promoting betting apps
