- PSEA emits data violation of notification of letter to more than 500,000 individuals
- It warned of a data violation that happened in July 2024
- Data violation exposed personal, financial and health information
A data violation at the Pennsylvania State Education Association (PSEA) has potentially exposed more than half a million people to identity theft, phishing or thread fraud.
Pennsylvania Public Sector Union has sent a review of data violation to 517,487 individuals to warn them of a cyber security event that happened in July 2024.
PSEA is a trade union and professional organization that represents public school teachers, faculty for higher education, school staff and retired teachers all over Pennsylvania. It has thousands of members and plays a crucial role in the negotiations on contracts, lobbying on educational financing and providing professional development. The association also focuses on student-centered policies and promotes safe and effective learning environments.
Rhysida strikes
“PSEA experienced a security event on July 6, 2024, which affected our network environment,” the message letter said.
“Through a thorough study and comprehensive review of affected data completed on February 18, 2025, we decided that the data acquired by the unauthorized actor contained some personal information belonging to persons whose information was included in certain files in our network.”
While the type of stolen information varies from person to person, it mostly contains personal, financial and health data.
People’s names, driver’s license numbers, Stats -ids, social security number, pin numbers, security codes, debit card information, passport information, taxpayer numbers, credentials, health insurance and medical information were all exposed to some degree.
While the organization did not discuss the threat actors, Bleeping computer found that the Ransomware group called Rhysida assumed responsibility for the attack in early September 2024.
Apparently, the organization demanded 20 BTC, which at that time corresponded to approx. 1.1 million dollars. It is unknown whether PSEA paid the demand for ransom or not, but the publication says the post was subsequently removed from the dark web bump.
Via bleeping computer
