York County School of Technology experienced a data breach between March 27, 2023, and April 26, 2023, exposing sensitive personal information of students, staff, applicants, and other individuals. The compromised data included names, addresses, Social Security numbers, driver’s license numbers, and state ID numbers, leading to potential risks of identity theft, fraud, and financial harm. The breach resulted in a class action lawsuit, alleging that the school failed to adequately protect private information. Affected individuals were notified and offered compensation either up to $5,000 for documented out-of-pocket losses (including credit monitoring, fraud resolution, and lost time) or a flat $45 payment for those without verifiable expenses. The settlement fund covers administrative costs, legal fees, and payouts to claimants, with payments expected within 60 days of court approval. The incident highlights significant vulnerabilities in data security, exposing both internal (employees, applicants) and external (students) stakeholders to long-term risks. The school denied wrongdoing but settled to avoid prolonged litigation, underscoring the financial and reputational consequences of the breach.
Source: https://www.claimdepot.com/settlements/york-data-settlement
TPRM report: https://www.rankiteo.com/company/york-county-school-of-technology
"id": "yor1893718100125",
"linkid": "york-county-school-of-technology",
"type": "Breach",
"date": "3/2023",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Students, staff, applicants, '
'and other individuals in the '
'U.S. whose PII was accessed',
'industry': 'Education (Vocational/Technical School)',
'location': 'York County, Pennsylvania, USA',
'name': 'York County School of Technology',
'type': 'Educational Institution'}],
'customer_advisories': {'deadlines': {'claim_submission': 'November 21, 2025',
'final_approval_hearing': 'December 2, '
'2025',
'opt_out': 'November 21, 2025',
'payout_distribution': 'Within 60 days '
'of final '
'approval'},
'mailing_address_for_claims': 'York County School of '
'Technology Data Breach '
'Litigation Settlement '
'Administrator, PO Box '
'25226, Santa Ana, CA '
'92799',
'settlement_website': 'Available for claims'},
'data_breach': {'data_exfiltration': True,
'personally_identifiable_information': ['Names',
'Addresses',
'Social Security '
'numbers',
'Driver’s license '
'numbers',
'State ID numbers'],
'sensitivity_of_data': 'High (includes SSNs and '
'government-issued IDs)',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Sensitive Personal Data']},
'description': 'York County School of Technology notified students, staff, '
'and applicants that their private information (including '
'names, addresses, Social Security numbers, and driver’s '
'license/state ID numbers) was compromised in a data breach '
'between March 27, 2023, and April 26, 2023. A class action '
'lawsuit alleged the school failed to adequately protect the '
'data, leading to a settlement offering payouts of up to '
'$5,000 for documented losses or a flat $45 payment for '
'affected individuals.',
'impact': {'brand_reputation_impact': 'Class action lawsuit and settlement',
'data_compromised': ['Names',
'Addresses',
'Social Security numbers',
'Driver’s license/state ID numbers'],
'financial_loss': {'individual_losses': {'credit_monitoring_fees': 'Eligible '
'for '
'reimbursement',
'fraud_resolution_costs': 'Eligible '
'for '
'reimbursement',
'identity_theft_losses': 'Eligible '
'for '
'reimbursement',
'lost_time': 'Up to 4 '
'hours at '
'$20/hour '
'($80 max)'},
'settlement_fund': {'attorneys_fees': 'Up to '
'$225,000 '
'(subject '
'to court '
'approval)',
'claim_payouts': {'flat_payment': '$45 '
'per '
'person '
'(no '
'documentation '
'required)',
'out_of_pocket_losses': 'Up '
'to '
'$5,000 '
'per '
'person '
'(documented)'},
'service_award': 'Up to '
'$2,000 '
'(class '
'representative)'}},
'identity_theft_risk': 'High (PII exposed)',
'legal_liabilities': {'denial_of_wrongdoing': True,
'settlement_agreement': True}},
'initial_access_broker': {'high_value_targets': ['Student records',
'Employee records',
'Applicant data']},
'investigation_status': 'Settled (class action lawsuit)',
'post_incident_analysis': {'corrective_actions': {'financial_compensation': True,
'settlement_agreement': True},
'root_causes': 'Alleged failure to adequately '
'protect private information'},
'references': [{'source': 'Class Action Settlement Notice'},
{'source': 'Settlement Administrator (York County School of '
'Technology Data Breach Litigation)'}],
'regulatory_compliance': {'legal_actions': {'class_action_lawsuit': True,
'settlement_approved': 'Pending '
'(final '
'approval '
'hearing '
'on '
'December '
'2, '
'2025)'}},
'response': {'communication_strategy': {'claim_process': {'deadline': 'November '
'21, '
'2025',
'mail_in_option': True,
'online_submission': True},
'notifications_sent': True,
'settlement_website': True}},
'stakeholder_advisories': {'claim_process': {'documentation_required_for_losses': True,
'payout_options': ['Electronic '
'payment',
'Paper check'],
'unique_ID_and_PIN_required': True},
'eligibility_criteria': ['Received notification '
'from York County School '
'of Technology',
'Current/former student, '
'staff, applicant, or '
'individual whose PII was '
'accessed']},
'threat_actor': 'Cybercriminals',
'title': 'York County School of Technology Data Breach (March–April 2023)',
'type': 'Data Breach'}