PSEA Ransomware Attack Exposes 500,000 Individuals

More than 500,000 individuals are being notified after a cyberattack on the Pennsylvania State Education Association (PSEA) compromised their personal data in July 2024. The union, which represents over 178,000 education professionals across Pennsylvania, said in breach notification letters that hackers accessed a trove of sensitive information.

"PSEA experienced a security incident on or about July 6, 2024 that impacted our network environment," stated the union.

The stolen data included Social Security numbers, health insurance records, passport information, payment card details, and other identifying documents. A forensic investigation that concluded on February 18, 2025, confirmed the breach affected 517,487 individuals.

The PSEA announced: “Through a thorough investigation and extensive review of impacted data which was completed on February 18, 2025, we determined that the data acquired by the unauthorized actor contained some personal information belonging to individuals whose information was contained within certain files within our network."

While PSEA did not name a specific threat actor, the Rhysida ransomware gang claimed the breach on September 9, 2024. The group allegedly demanded a ransom of 20 BTC (over $1 million at the time), threatening to leak the stolen data if unpaid. The gang later removed the listing from its dark website, but PSEA has not confirmed whether a ransom was paid.

The Rhysida group, which operates a ransomware-as-a-service (RaaS) model, has previously targeted high-profile organizations, including the City of Columbus, the British Library, and Sony’s Insomniac Games. US federal agencies like the FBI and CISA have issued warnings about the group’s ongoing threats.

In response, PSEA is offering one year of free credit monitoring and identity restoration services through IDX to individuals whose Social Security numbers were compromised. Enrollment is open until June 17, 2025.

Impacted individuals are urged to remain vigilant by reviewing financial statements, placing fraud alerts on credit files, and securing their online accounts.