Half a million people impacted by Pennsylvania State Education Association data breach

More than 500,000 people were impacted by a cyberattack on the Pennsylvania State Education Association (PSEA) that took place in July 2024.

The organization published breach notices in several states and on its website, warning its current and former members as well as their dependants that hackers broke into their systems last year and stole state IDs, Social Security numbers, financial account numbers, payment card information, passport numbers, taxpayer IDs, health insurance information and medical data.

The organization notified law enforcement and worked with cybersecurity experts to resolve the incident. In total, PSEA said 517,487 people were impacted. 

“PSEA experienced a security incident on or about July 6, 2024 that impacted our network environment,” the organization said.

“Through a thorough investigation and extensive review of impacted data which was completed on February 18, 2025, we determined that the data acquired by the unauthorized actor contained some personal information belonging to individuals whose information was contained within certain files within our network.”

PSEA represents more than 177,000 teachers, school nurses, bus drivers, cafeteria workers and others in roles across Pennsylvania’s public schools. The organization bargains compensation and benefits on behalf of school workers and has existed since 1852. 

The organization filed breach notifications in Maine, Massachusetts and New Hampshire.

The attack on PSEA was claimed by the Rhysida ransomware gang in September. PSEA said in its letters to members that it “took steps, to the best of our ability and knowledge, to ensure that the data taken by the unauthorized actor was deleted.” 

Rhysida continues to be one of the most aggressive ransomware gangs currently operating, repeatedly targeting hospitals; churches; nonprofits; city government bodies in London, Seattle, Columbus and Hoboken; and countries like Kuwait as well as Portugal.

Last year, a prominent school district in the Washington, D.C., suburbs said it was also attacked by the gang, exposing the personal information of nearly 100,000 people.