The Washington State Office of the Attorney General disclosed that NOLS (National Outdoor Leadership School) fell victim to a ransomware attack, resulting in the unauthorized exfiltration of personal data belonging to 3,049 Washington residents. The breach occurred intermittently between February 7, 2020, and May 20, 2020, but was only detected on August 11, 2020. The compromised information included names and dates of birth, though no financial records, Social Security numbers, or other highly sensitive data were exposed. While the attack did not involve financial theft or systemic operational disruption, the exposure of personally identifiable information (PII) poses risks such as identity fraud, phishing, or reputational harm to affected individuals. The incident underscores vulnerabilities in NOLS’ cybersecurity defenses, particularly in detecting and mitigating prolonged unauthorized access. The lack of financial or critical data compromise limits the immediate severity, but the personal data leak of customers remains a significant concern under data protection regulations.