Stolen LAUSD Data Posted by Ransomware Group

The ransomware gang Vice Society began posting Sunday thousands of files it apparently stole last month from the LA Unified School District’s computer systems during a failed ransomware cyber-attack.

According to a law enforcement source familiar with the investigation the files made public on the group’s known website included some confidential psychological assessments of students, contract and legal documents, business records, and numerous database entries.

A portion of the data appeared to contain personal identifying information, including some social security numbers, the source said.

LAUSD declined to comment on the data release or its contents early Sunday, and referred back to a public statement Friday that confirmed a threat to release the files posted late last week was legitimate and promised additional information once the impact of the data breach was known.

LAUSD declined to comment on the data release or its contents early Sunday, and referred back to a public statement Friday that confirmed a threat to release the files posted late last week was legitimate and promised additional information once the impact of the data breach was known.

“Paying ransom never guarantees the full recovery of data, and Los Angeles Unified believes public dollars are better spent on our students rather than capitulating to a nefarious and illicit crime syndicate,” the statement said.

The LA Times reported that Superintendent Alberto Carvalho said there was a demand for payment, which was not included in the District’s statements to the public.

“But this level of demand was, quite frankly, insulting,” Carvalho told the Times. “And we’re not about to enter into negotiations with that type of entity.”

The Vice Society site included a message Sunday that said, “CISA wasted our time, we waste CISA reputation,” near a link to download the LAUSD files.

The group posted last week that it intended to release the stolen files on Tuesday.

CISA is the acronym for the federal cyber-security agency that published a national warning in early September about Vice Society targeting educational institutions.

The LAUSD said in its statement Friday that it would provide an update in the event the stolen material was released.

“To our school community and partners, we will update you when we have relevant information, and notify you if your personal information is impacted, as appropriate,” the District said.

“We also expect to provide credit monitoring services, as appropriate, to impacted individuals. We will have more to share about how to sign up for credit monitoring services in the coming days,” the statement said.