Pennsylvania teachers' union confirms data breach affecting over 500,000

The Pennsylvania State Education Association (PSEA) has disclosed a significant data breach that compromised the personal information of more than 500,000 individuals. The teachers' union, which represents educators and school staff across the state, revealed that cybercriminals accessed its network in July 2024, stealing sensitive data.

Details of the breach

According to PSEA, the breach occurred around July 6, 2024. However, it was not until February 18, 2025, that the organization determined the stolen files contained personal information. This week, the union began notifying affected individuals.

The stolen data includes:

• Names and dates of birth

• Driver’s license and state ID details

• Passport numbers

• Social Security numbers

• Account information, usernames, and passwords

• Payment card details

• Taxpayer ID numbers

• Health insurance and medical records

Despite the severity of the breach, PSEA stated that there is no evidence the stolen information has been used for identity theft or financial fraud. “Nevertheless, out of an abundance of caution, we want to make the impacted individuals aware of the incident,” the union said in a statement.

Possible ransomware attack

While PSEA has not publicly confirmed the nature of the attack, its statement suggests the organization negotiated with the attackers to have the stolen data deleted—a common practice in ransomware incidents.

Further corroborating this, the Rhysida ransomware gang took credit for the attack, listing PSEA on its Tor-based leak site in September 2024. The group threatened to auction the stolen data unless a ransom of 20 Bitcoin (approximately $1.2 million at the time) was paid. It remains unclear whether PSEA met the demand or negotiated a different settlement.

Response and mitigation efforts

In a filing with the Maine Attorney General’s Office, PSEA reported that 517,487 individuals were affected by the breach. To help mitigate potential risks, the union is offering one year of free credit monitoring and identity restoration services to those impacted.

PSEA has not disclosed the specific vulnerabilities exploited in the attack but has stated it is implementing additional security measures to prevent future breaches.

Cybersecurity experts are urging affected individuals to take extra precautions including enabling multi-factor authentication on accounts and staying alert for phishing attempts.