Pacific Union College discloses ransomware breach affecting 56,041 people

Pacific Union College, a private college in Angwin, California, disclosed in November 2023 that attackers had been inside its network between March 5 and March 19, 2023. The college reported the breach to the California Attorney General's office on November 7 and began notifying victims the following day, putting the total at 56,041 people.

The exposed records spanned several groups. Employee data included names, addresses, dates of birth, Social Security numbers and tax information. Student records included names, addresses, dates of birth and detailed financial information, among them Student Aid Reports carrying family income and tax details. Parents and donors also had personal and financial information taken, and the filings referenced credit and debit card numbers and financial aid documents.

The Trigona ransomware group claimed responsibility and said it had taken roughly 120GB of college data. Trigona dated its own attack to March 27, published sample files and, according to teiss, spent about a month in negotiations with the college.

The disclosure timeline drew criticism. The college acknowledged a cybersecurity problem on April 7, 2023, confirmed a targeted ransomware attack on May 3, and issued a final web update in June saying there was no evidence personal information had been compromised. Formal notification followed roughly eight months after the intrusion. Class action law firms opened investigations within days of the notices going out.