Pennsylvania State Education Association to pay $2.5M after data breach

The settlement is in response to a 2024 data breach that compromised the sensitive personal information of educators in Pennsylvania.

What happened

The Pennsylvania State Education Association (PSEA), a union that represents teachers and other individuals in education (including health care workers, psychologists, social workers, and more), recently agreed to settle a class action lawsuit, Melanie Hudson et al. v. Pennsylvania State Education Association, stemming from a 2024 data breach.

Plaintiffs consolidated a class action suit again PSEA on May 19th, 2025. Initially, PSEA filed an objection to the complaint, but ultimately decided to settle the case with the assistance of a class action mediator.

The settlement allows PSEA to maintain that they committed no wrongdoing. However, the organization has agreed to a $2.5 million settlement fund, which will go towards class members who submit a claim, service awards for the class representatives, attorney fees, and administrative costs related to the settlement.

The backstory

According to court documents, cybercriminals gained unauthorized access to PSEA’s network on July 6th, 2024 and may have exfiltrated private information, including full names, addresses, Social Security numbers, driver’s license numbers or state IDs, account information, payment and financial information, and health insurance and medical information. The incident ultimately impacted approximately 517,000 individuals. On March 18th, 2025, following an investigation, PSEA began providing notices to impacted individuals.

The big picture

Educators and those who work in the education field often rely on their union to guide their choices on legal issues. In this particular case, PSEA noted on their website that they would be unable to provide advice to class action members. Data breaches against any organization, but especially those who are relied on by individuals for advice, be it legal or medical, can feel jarring. According to one study on consumer trust at large, “When people face potential security threats, they are often more careful about their data and the platforms they use.” The study adds that with weakened trust individuals may “hesitate to share their personal information online.” For many, organizations like educator unions and healthcare practices are critical, and when trust breaks down, the people who need those services may feel uncomfortable using them. Any organization or business that relies on consumer or patient relationships must also prioritize protecting data.

FAQs

Can PSEA face any other lawsuits following this settlement?

The settlement agreement specifically notes that both parties may “discover facts other than or different from” what they believe to be true, but once those individuals agree to the settlement, they will waive their rights to bring new claims in this case. Most impacted individuals will likely agree to the settlement, but if they chose not to, they could theoretically bring about a new case against PSEA if new information is discovered. Otherwise, this incident will be put to rest with the courts.