The Washington State Office of the Attorney General disclosed a ransomware attack targeting Pacific University, which occurred between February 7, 2020, and May 20, 2020, and was detected on July 16, 2020. The breach compromised sensitive personal data of 9,196 individuals, including names, full dates of birth, and demographic details. The attack resulted in unauthorized access to personally identifiable information (PII), posing risks such as identity theft, financial fraud, and reputational harm to affected individuals. While the university took steps to investigate and mitigate the incident—including notifying impacted parties and offering credit monitoring—the breach highlighted vulnerabilities in its cybersecurity defenses. The involvement of ransomware suggests that attackers may have encrypted critical systems, further disrupting operations and potentially demanding payment for data restoration. The exposed data, though not explicitly financial or medical, still carries significant privacy risks, particularly if exploited for targeted phishing or social engineering attacks. The prolonged duration between the breach and its discovery (over five months) underscores challenges in early threat detection, amplifying the potential consequences for both the university and those affected.