Los Angeles Unified, with over 600,000 students, suffers ‘significant infrastructure disruption’ but classes set to take place as usual
Marlton school in Los Angeles. The district said the investigation and response involved the White House and the FBI. Photograph: Étienne Laurent/EPA
Hackers targeted the second-largest school district in the US with a cyber-attack over Labor Day weekend, officials at Los Angeles unified school district have confirmed.
The district characterized the cyber-attack as a “significant disruption to our system’s infrastructure” but officials said they did not expect major problems with teaching or such services as transportation and food. It said business operations might be delayed or modified.
Classes were scheduled to take place as usual on Tuesday morning, the district – which includes more than 600,000 students in kindergarten through 12th grade – said in a statement.
“Since the identification of the incident, which is likely criminal in nature, we continue to assess the situation with law enforcement agencies,” the district said, adding that a “response protocol” was implemented to mitigate districtwide disruptions, including access to email, computer systems and applications.
The perpetrators appear to have targeted the facilities systems, which involves information about private-sector contractor payments which are publicly available through records requests rather than confidential details like payroll, health and other data, officials said.
Authorities believe the attack originated internationally and have identified three potential countries where it may have come from, though the Los Angeles Unified superintendent, Alberto Carvalho, would not say which countries may be involved.
The district said the investigation and response involved the White House, the US Department of Education, the FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency.
The attack comes as ransomware is on the rise, targeting the education sector at higher rates than it had been before. In August and September 2021, 57% of ransomware incidents reported to the FBI involved K-12 schools compared to 28% of incidents from January through July.
Advertisement
In 2021 56% of K-12 schools and 64% of higher education organizations surveyed by digital security firm Sophos reported being hit by some type of ransomware.
“This egregious cyber-attack is the latest example of the pervasive threat that predatory cybercriminals pose to everyone from multinational businesses to young schoolchildren,” said Darren Guccione, CEO and co-founder of the cybersecurity firm Keeper Security. “No one is safe from cybercrime and often the most vulnerable among us are the most likely to be targeted.”
The increase has come as the Covid pandemic forced much of the education sector online, while schools struggle to keep up security practices. In an advisory to schools released in 2021, the FBI suggested more training of employees to monitor networks for suspicious activities.
Schools are an attractive target for hackers for a variety of reasons, said Matthew Warner, co-founder and chief technology officer at the cybersecurity firm Blumira. Schools often lack of funding for full-time IT staff, and many students use their own, unsecured devices, giving hackers more opportunities to breach networks.
“Most IT leaders in education operate on a shoestring budget,” he said. “Plus, lower budgets in education make it difficult to hire and retain cybersecurity talent without a competitive salary to offer.”
A ransomware extortion attack in the biggest school district in Albuquerque, New Mexico, forced schools to close for two days in January.
The FBI suggests schools not paying ransoms, but 45% of K-12 victims and 50% in higher education reported paying the ransom to reinstate lost data.
It is not clear if LAUSD paid the ransom in this attack, but the district is calling for an independent taskforce to help prevent future attacks.
- The Associated Press contributed to this report
… as you’re joining us today from India, we have a small favour to ask. Tens of millions have placed their trust in the Guardian’s fearless journalism since we started publishing 200 years ago, turning to us in moments of crisis, uncertainty, solidarity and hope. More than 1.5 million supporters, from 180 countries, now power us financially – keeping us open to all, and fiercely independent.
Unlike many others, the Guardian has no shareholders and no billionaire owner. Just the determination and passion to deliver high-impact global reporting, always free from commercial or political influence. Reporting like this is vital for democracy, for fairness and to demand better from the powerful.
And we provide all this for free, for everyone to read. We do this because we believe in information equality. Greater numbers of people can keep track of the events shaping our world, understand their impact on people and communities, and become inspired to take meaningful action. Millions can benefit from open access to quality, truthful news, regardless of their ability to pay for it.
Every contribution, however big or small, powers our journalism and sustains our future.
https://www.theguardian.com/us-news/2022/sep/06/los-angeles-unified-school-district-cyber-attack?
