Lawsuits have been filed in the U.S. District Court by teachers union members impacted by the data breach.
Three members of Pennsylvania’s largest teachers union allege the union was negligent in failing to prevent a personal data theft last July, according to federal lawsuits.
Following the discovery of the breach, the Pennsylvania State Education Association finished its investigation on February 18th and did not notify members until March 18th, according to the lawsuits.
The lawsuits were filed on March 19th in the U.S. District Court for the Middle District of Pennsylvania. One lawsuit says, “Immediate notification of a data breach is critical so that those impacted can take measures to protect themselves.”
The suit says members have suffered “financial losses” and lost time “detecting and preventing identity theft” due to the length of time it took for the union to tell members about the personal data theft that was discovered.
The union represents 187,000 teachers and school support staff.
The union told the Maine attorney general’s office that 517,587 people were affected by the breach. This included 77 people from the state of Maine, which requires reporting of data breaches of its residents.
Chris Lilienthal, spokesman for the teachers union, released a statement, saying, “As soon as we became aware of this incident, we engaged cybersecurity professionals with expertise in these occurrences. PSEA is not aware of any incidents of identity theft related to this event. We are complying with all legal and regulatory requirements and are providing credit monitoring for eligible individuals who were impacted by this incident.”
The union said the stolen information could include birthdates, driver’s licenses or state IDs, Social Security numbers, account numbers, personal identification numbers, passwords, security codes, routing and payment card numbers, passport numbers, taxpayer ID numbers, and health insurance and medical information.
Over 500,000 individuals had personal data stolen in a breach impacting the Pennsylvania State Education Association. #Cybersecurity #DataBreach #InfoSec #Privacy #EducationSecurity https://t.co/wPuHjCwPvv
— Josh Moulin (@JoshMoulin) March 28, 2025
The notice posted on the union’s website says, “We have no evidence that any of the information has been used for identity theft or to commit financial fraud. Nevertheless, out of an abundance of caution, we want to make the impacted individuals aware of the incident.”
The union said it had taken steps to have the data taken by the unauthorized actor deleted, and that it would provide impacted individuals with steps to protect their information.
One member that filed a lawsuit said she is receiving more spam calls and emails. The lawsuits seek class action status, as well as unspecified damages, restitution, and attorney’s fees and costs.
