<\/p>\n
Los Angeles Unified<\/span> School District, or LAUSD \u2014 the second largest district in the U.S. with more than 1,000 schools and 6,000 students \u2014 confirmed this week that it was hit by a cyberattack over the weekend, disrupting access to its IT systems.<\/p>\n Details about the incident, described as \u201ccriminal in nature\u201d and later confirmed to be ransomware, remain vague. It\u2019s not yet known whether data was stolen, and while LAUSD resumed classes as planned on Tuesday following the long Labor Day weekend, the impact on schools is currently unclear. LAUSD\u2019s chief communications officer Shannon Haber has not responded to multiple requests for comment.<\/p>\n While there is a lot we don\u2019t yet know, a number of details about the incident are beginning to emerge.<\/p>\n Vice Society, a Russian-speaking ransomware group and known for targeting the education sector, claimed responsibility for the LAUSD ransomware attack.<\/p>\n Vice Society is a double-extortion ransomware group, meaning it typically exfiltrates a victim\u2019s sensitive data as well as encrypting it. The group is known to break into its victim\u2019s networks by\u00a0exploiting the Windows PrintNightmare vulnerability.<\/p>\n A review of Vice Society\u2019s leak site does not yet list LAUSD, but a number of other U.S. school districts are currently listed on the site, including Wisconsin\u2019s Elmbrook Schools and the Moon Area School District in Allegheny County.<\/p>\n asked LAUSD whether it could confirm that Vice Society was behind the attack but did not receive a response.<\/p>\n The claim by Vice Society comes days after the FBI and CISA warned that the ransomware group, which has been active since 2021, is \u201cdisproportionately targeting the education sector with ransomware attacks.\u201d A joint government advisory this week warns that K-12 education institutions, like LAUSD, have been frequent targets of attacks, which have led to restricted access to networks and data, delayed exams, canceled school days, and the theft of personal information belonging to students and staff.<\/p>\n Brett Callow, a ransomware expert and threat analyst at Emsisoft, told that LAUSD is the fiftieth education sector entity to be hit with ransomware this year alone.<\/p>\n While LAUSD has not yet confirmed the impact of the ransomware attack, the district said in an update\u00a0on September 8 that it is making progress towards \u201cfull operational stability\u201d for a number of key IT services. LAUSD hasn\u2019t said which services are back up and running, but previously said students and teachers might be unable to access email, Google Drive and Schoology, a popular learning management system.<\/p>\n LAUSD said that all compromised credentials were fully deactivated to protect network integrity and added that it\u2019s expediting the rollout of multi-factor authentication across the district. LAUSD was in the process of a large-scale rollout of multi-factor authentication, with an aim to make the security feature mandatory for employees and contractors starting on September 12, according to a LAUSD notice<\/a> that was later posted on Twitter.<\/p>\n Superintendent Alberto M. Carvalho said: \u201cThis incident has been a firm reminder that cybersecurity threats pose a real risk for our District \u2014 and districts across the nation.\u201d<\/p>\n Earlier this week, reports emerged that \u201cat least 23\u201d login credentials of LAUSD employees appeared on the dark web. The credentials reportedly contained email addresses and passwords, and at least one set of credentials is said to have unlocked an account for the district\u2019s virtual private network\u00a0service.<\/p>\n However, in its update published, LAUSD said that \u201ccompromised email credentials reportedly found on nefarious websites were unrelated to this attack, as attested by federal investigative agencies.\u201d<\/p>\n LAUSD was the target of a previous ransomware attack in 2021, according to threat intelligence company Hold Security, via cybersecurity reporter Jeremy Kirk<\/a>. According to the company, a school psychologist\u2019s machine was infected with Trickbot, a financially motivated malware that is sometimes used as a precursor to a ransomware attack.<\/p>\nVice Society claims responsibility<\/h2>\n
Response from LAUSD<\/h2>\n
Dark web data leak debunked<\/h2>\n
A previous ransomware attempt?<\/h2>\n