Ransomware Attack Cripples LAUSD Systems; Prompts White House Response

LOS ANGELES, CA — The Los Angeles Unified School District is reeling today following a cyber attack affecting hundreds of thousands of students and staff over the holiday weekend.

The district tweeted instructions for all students and staff to change their school district passwords Tuesday morning. The massive ransomware cyberattack on the Los Angeles Unified School District information technology systems prompted a federal investigation and a White House response to the attack on the nation's second largest school district

Despite the attack, classes resumed as scheduled Tuesday. However, district officials warned of a "significant disruption to our system's infrastructure."

The attack affected the LAUSD website and email system and may delay food or Beyond the Bell services and business operations Tuesday. The attack did not impact employee health care and payroll nor safety and emergency mechanisms in place at schools.

"Los Angeles Unified detected unusual activity in its information technology systems over the weekend, which after initial review, can be confirmed as an external cyber attack on our information technology assets," the school district announced. "Since the identification of the incident, which is likely criminal in nature, we continue to assess the situation with law enforcement agencies."

The U.S. Department of Education, the FBI and the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency have been called in to investigate, according to the district.

On Tuesday, the district announced that all students and staff will need to change their lausd.net passwords, but it set specific times for when those changes should be made, and stressed the change "must be completed at a district site."

To minimize wait times while the changes were being made, the district set a schedule of 7 a.m. for administrators and teachers, 9 a.m. for support staff, 10 a.m. for high school students and 11 a.m. for elementary/middle school students.

District officials said they immediately established a plan of action to provide protection in the future, "informed by top public and private sector technology and cyber security professionals."

The plan includes the following actions:

• Independent Information Technology Task Force: Charged with developing a set of recommendations within 90 days, including monthly status updates;
• Additional Human Resources: Deployment of IT personnel at all sites to assist with technical issues that may arise in the coming days;
• Technology Investments: Full-scale reorganization of departments and systems to build coherence and bolster data safeguards;
• Advisory Council: Charged with providing ongoing advisement on best practices and systems, including emerging technological management protocols;
• Technology Advisor: Directed to focus on security procedures and practices, as well as conduct an overall data center operations review that includes an assessment of existing technology, critical processes and current infrastructure;
• Budget Appropriation: Directed appropriation of any necessary funding to support Information Technology Division infrastructure enhancement;
• Employee Training: Develop and implement mandatory cybersecurity responsibility training;
• Forensic Review: Expand ongoing assistance from federal and state law enforcement entities to include a forensic review of systems;
• Expert Team: Creation and deployment of an expert team to assess needs and support the implementation of immediate solutions.

LAUSD Superintendent Alberto Carvalho was expected to provide more information about the attack at a press briefing late Tuesday morning at Edward R. Roybal Learning Center.

City News Service, Inc. and Patch staffer Paige Austin contributed to this report.