Savannah College of Art and Design (SCAD) was targeted in a ransomware attack that resulted in a data breach in which a large amount of data was exfiltrated. However, unlike some ransomware attacks, the college’s network was not encrypted; only data was exfiltrated. More than 69,000 files were exfiltrated having routine college business such as personnel-related files and student files with personal information. The breach included people’s names and clues as to the content of the files (e.g., passports, payroll-related information, bank statements, personal statements, recommendation letters, etc.). Some of the files contained more than 15,000 records going back to 2005.