Hackers infiltrate second-largest US school district in growing trend

Hackers targeted the second-largest school district in the US with a cyber-attack over Labor Day weekend, officials at Los Angeles unified school district have confirmed.

The perpetrators appear to have targeted the facilities systems, which involves information about private-sector contractor payments which are publicly available through records requests rather than confidential details like payroll, health and other data, officials said.

Authorities believe the attack originated internationally and have identified three potential countries where it may have come from, though Los Angeles Unified Superintendent Alberto Carvalho would not say which countries may be involved.

The attack comes as ransomware is on the rise, targeting the education sector at higher rates than it had been before. In August and September 2021, 57% of ransomware incidents reported to the FBI involved K-12 schools compared to 28% of incidents from January through July.

In 2021 56% of K-12 schools and 64% of higher education organizations surveyed by digital security firm Sophos reported being hit by some type of ransomware.

The increase has come as the Covid pandemic forced much of the education sector online, while schools struggle to keep up security practices. In an advisory to schools released in 2021, the FBI suggested more training of employees to monitor networks for suspicious activities.

Schools are an attractive target for hackers for a variety of reasons, said Matthew Warner, co-founder and chief technology officer at the cybersecurity firm Blumira. Schools often lack of funding for full-time IT staff, and many students use their own, unsecured devices, giving hackers more opportunities to breach networks.

The FBI suggests schools not paying ransoms, but 45% of K-12 victims and 50% in higher education reported paying the ransom to reinstate lost data.

It is not clear if LAUSD paid the ransom in this attack, but the district is calling for an independent taskforce to help prevent future attacks.