Los Angeles Unified School District targeted by ‘ransomware attack’

Schools across the Los Angeles area were due to reopen as normal, following a weekend cyberattack described as being likely “criminal in nature” by Los Angeles Unified School District (LAUSD) officials.

Lessons were due to resume as planned after the Labor Day holiday weekend when the cyberattack caused multiple technological disruptions with teachers, parents and students unable to access files or log-in, a statement said.

Social media posts from confused parents and teachers suggested that LAUSD users had been prompted to reset their passwords before being locked out of their accounts on Monday, the Los Angeles Times reported, before school officials confirmed the cause of the trouble.

Issuing a statement late on Monday night, LAUSD said the problems were due to a cyberattack and that it required assistance from multiple law enforcement agencies which included the FBI and Department of Homeland Security.

“The White House brought together the Department of Education, the Federal Bureau of Investigation (FBI) and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) to provide rapid, incident response support to Los Angeles Unified, building on the immediate support by local law enforcement agencies,” the school district announced.

LAUSD schools were expected to reopen on Tuesday as normal however after the Labor Day weekend, when the LAUSD said its website also went offline before being restored. An investigation into the likely “criminal” incident is underway.

“We are working collaboratively with our partners to address any and all impacted services,” the school district said. “Based on a preliminary analysis of critical business systems, employee healthcare and payroll are not impacted, nor has the cyber incident impacted safety and emergency mechanisms in place at schools.”

Describing the nature of the “ransomware” attack as “criminal”, LAUSD officials added that it “can be confirmed as an external cyber attack on our Information Technology assets” which was “likely criminal in nature”.

“We continue to assess the situation with law enforcement agencies,” the school district said. “While the investigation continues, Los Angeles Unified has swiftly implemented a response protocol to mitigate Districtwide disruptions, including access to email, computer systems and applications. This communication is being published after extensive, required vetting and approval by a number of entities and agencies.”

It remains unclear who was behind the attack, which follows a similar incident in 2020 involving California’s Newhall school district, the LA Times reported.