Los Angeles School District Faces Labor-Day-Weekend Cyberattack
- By Matt Jones
- September 07, 2022
Officials from the Los Angeles Unified School District, the second-largest school district in the country, have confirmed that the district was hit with a cyberattack over Labor Day weekend, according to national news. The attack did not affect district operations like teaching, transportation or food service, said officials, and classes for 600,000 K–12 students resumed as normal on Tuesday morning.
National news reports that hackers targeted the district’s facilities systems that store information related to private-sector contracts, which are also publicly available through records requests. Officials said that private data like payroll, health and student information were not affected.
“Since the identification of the incident, which is likely criminal in nature, we continue to assess the situation with law enforcement agencies,” said the district. Officials called the attack a “significant disruption to our system’s infrastructure” and implemented a “response protocol” to lessen the chance of district-wide disruptions. National news reports that the investigation and response is being conducted with the help of the White House, the U.S. Department of Education, the FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency.
The Los Angeles Times reports that the attack was detected at about 10:30 p.m. local time on Saturday. Officials took the district’s website offline and temporarily revoked access to staff and student email and other systems that educators use to post lessons and take attendance. By Tuesday, most online services including emergency systems were back online.
In a news conference, LAUSD Superintendent Alberto Carvalho said that the attack was launched by a “ransomware tool that temporarily disabled systems, froze others and had access to some degree of data.” However, he said that the district has not yet received a ransom demand.
Authorities said they believe the attack was initiated internationally and have identified three possible countries of origin. Carvalho declined to provide further details about the nature of the attack or which countries are potentially involved.