Lee University

Summary

Lee University agreed to pay $1.75 million to settle a class action alleging it negligently failed to protect personal information of nearly 137,000 individuals exposed in a data breach, with affected parties eligible for up to $5,000 in documented loss reimbursement, a pro rata payment of about $100, and one year of credit‑monitoring. The incident, identified early in an investigation, involved a ransomware group called Medusa that threatened to release collected files within a week to ten days unless a payment was made, prompting the institution to contain the breach, notify students, and continue classes while IT staff worked with external resources to secure the environment.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On the morning of March 22, 2024, Lee University’s administration reported that it had become aware of a potential security incident early that Friday. The university’s IT department, assisted by external resources, took immediate measures to contain the suspected incident and to secure the institution’s environment. Classes continued as scheduled while the investigation remained ongoing and the university stated it could not share specific details about the nature or scope of the incident. A security expert cited by local media noted that a notification from the Medusa ransomware group had been posted, explaining that such groups typically impose a seven‑to‑ten‑day deadline for releasing stolen data unless a payment is made.

The incident resulted in the exposure of personal information belonging to nearly 137,000 individuals associated with the university. In May 2026, Lee University agreed to pay $1.75 million to settle a proposed class action that alleged the school had negligently failed to protect that data. Under the settlement, class members could claim up to $5,000 for documented losses stemming from the breach, receive a pro rata cash payment of approximately $100, and be provided with one year of credit‑monitoring services. Judge Curtis L. Coller of the U.S. District Court for the Eastern District of Tennessee granted preliminary approval of the settlement motion.

During the period following the incident, some students reported having to seek alternative Wi‑Fi connections in coffee shops and other locations due to network disruptions, while others expressed concern about whether their information was being adequately safeguarded. The university maintained that classes had returned to normal and that the breach had not significantly disrupted academic activities, though it acknowledged inconveniences for certain individuals. The investigation into the breach continued, with no further technical details released publicly beyond the statements already provided.

Sources

Sources available to members: 2 sources.