Pennsylvania State Education Association
bd_9ec6a1b78fc5745e · schema v1 · pii pii-v1
Full breach record for Pennsylvania State Education Association →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Rhysida on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Pennsylvania State Education Association PSEA is 178,000 members strong a community of education professionals who make a difference in the lives of Pennsylvania's students every day.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Jul 6, 2024
Claim posted
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- Indiana State AGbd_86a32e9f685891e12025-03-17 · +254dVerified by operator
- Nebraska State AGbd_cf0a4f5883e3837c2025-03-17 · +254dVerified by operator
- Massachusetts State AGbd_118ed495b3e5b1fd2025-03-18 · +255dVerified
- Maine State AGbd_18c2400cad54db482025-03-18 · +255dVerified
Show 6 more filings ↓Show fewer ↑up to 256d gap
- New Hampshire State AGbd_410f8f4728a914372025-03-18 · +255dVerified by operator
- Washington State AGbd_4eadf3bce2328f762025-03-18 · +255dVerified by operator
- Montana State AGbd_8b3ad0c34719e9662025-03-18 · +255dVerified
- Maryland State AGbd_b6cf1deaa264fa8a2025-03-18 · +255dVerified by operator
- Delaware State AGbd_e3037620ed0e1d3f2025-03-18 · +255dVerified by operator
- Vermont State AGbd_ab8d33219fbbcab52025-03-19 · +256dVerified by operator
Filing propagation · 10 filings · 10 states
View merged incident ↗Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
rhysida
According to ransomware.live, Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin. After encryption, the ransomware appends the extension '.ryshida' to encrypted files. Source: https://github.com/crocodyli/ThreatActors-TTPs