LAUSD’s cyberattack a ‘wake-up’ call to secure its online systems, officials say

The investigation into the cyberattack that prompted the Los Angeles Unified School District to disable all of its computer systems over the weekend is expected to be lengthy and involve multiple law enforcement agencies including the FBI, officials said Tuesday, Sept. 6, highlighting the gravity of the situation.

LAUSD personnel first noticed “unusual activity” in its Information Technology systems around 10:30 p.m. Saturday and worked to immediately notify law enforcement and shut down the district’s computer systems, Superintendent Alberto Carvalho said during a news conference Tuesday.

The ransomware that was used temporarily disabled some LAUSD systems, froze others and gave the attacker or attackers “access to some degree of data,” he said.

However, he said, as of Tuesday morning, the investigation had not turned up evidence to suggest that confidential student or personnel information had been breached. Rather, a system used by the facilities department that contains information such as payments to contractors – much of which is already public record – appeared to be the attacker’s point of entry.

“We have already confirmed that payroll information was undisturbed,” Carvalho said. “We have no evidence that critical health information, social security numbers were compromised. But we are re-verifying, obviously, that type of information.”

Carvalho also said the district received no ransom demand despite the use of ransomware by the attackers.

L.A. Mayor Eric Garcetti, the police chiefs for both the city and school district’s police departments, as well as a representative for the FBI, also spoke at the press conference, underscoring the need to work together to combat cyberattacks.

LAPD Chief Michel Moore called such cyberattacks “the No. 1 threat to our safety.” Both he and the mayor called the LAUSD incident a “wake-up call” that all government agencies, businesses and individuals should be vigilant to guard against security breaches.

“This is a wake-up call, a reminder, because all of us are so dependent on our cyber universe, to check our systems, to recognize that personal, businesses, public and private sector, are constantly being probed and constantly under attack, and that is why it’s critical that you pay attention to your security system, that you pay attention to who your users are and that you’re constantly on vigilance,” Moore said.

School board Vice President Nick Melvoin, meanwhile, condemned whoever orchestrated the cyberattack.

“This was an act of cowardice – a criminal act against kids, against their teachers and against an education system,” he said.

Because the investigation is ongoing, officials would not go into detail about who may be responsible for the attack, though the superintendent said it appeared the incident originated outside the country.

“There are three nations that the investigators have traced some degree of trail to, but that doesn’t necessarily indicate that that’s where the attack came from,” Carvalho said.

He explained that such trails are “sometimes just a stopping point, as a behind-the-curtain activity that takes place, but it does appear at this point that this incident originated beyond our borders.”

Students, staff impacted

Although confidential information appeared not to have been compromised in LAUSD’s case, Carvalho said the district chose to shut down all systems when personnel first detected the cyber attack because, at the time, they did not know who was responsible or which systems they were after.

“By shutting down all of the systems, we were able to stop the propagation of this event and restricting its potential damage,” he said. “That was the right call at the right moment.”

Still, some parents and district employees questioned why it took the district until late Monday to communicate what was going on.

Carvalho said it took the district until about 9 p.m. Monday to scan all the systems it had previously shut down to ensure they would be operable the next morning. Additionally, the steps the district decided to take had to be coordinated and vetted first by various local, state and federal government agencies, he said.

Among the federal agencies who provided rapid response assistance to the district over the weekend were personnel from the U.S. Department of Education, the FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, the district said.

On Tuesday morning, the district’s website remained down and did not resume operations until the afternoon.

The cyber attack also caused other disruptions to the school day throughout the vast LAUSD system.

All staff and students were required to reset their passwords to access emails and a system for posting and submitting class assignments. Some teachers reported not having access to lesson plans before the start of the school day, though Carvalho expressed confidence that the educators were trained professionals who would be able to adapt if necessary.

“It is not a play day,” he said when asked if Tuesday amounted to a “play day” for students in classes where teachers may not have had access to their lesson plans.

“We have fantastic teachers that can teach and were trained to be able to default to a different modality, different resource, if something like this happens,” the superintendent said.

Carvalho called the resetting of passwords the day’s biggest challenge since it impacted more than half a million students and staff. Early Tuesday morning, there was about a 15-minute wait time to reset passwords, but by mid-morning, the wait time had been reduced to about 4½ minutes, he said.

Around 9:30 a.m., Carvalho tweeted that roughly 53,000 passwords had been reset, though there were still hundreds of thousands more to go.

Staff and students who work or attend school in person were required to reset their passwords on campus, while the approximately 7,000 students in the district’s online Virtual Academy could do so by calling a hotline number from home – though officials acknowledged there might be a wait time.

Steps moving forward

The district has initiated a process to form a technology task force made up of personnel from federal agencies, and experts in internet technology, to review LAUSD’s protocols. The task force would be expected to issue within 30 days recommendations for immediate steps the district could take to improve its security, along with a second interim report after 60 days and final recommendations within 90 days.

Other steps the district has taken or plans to take include:

• Deploying IT personnel to LAUSD sites to assist with technical issues that arise in the coming days;Fully reorganizing departments and systems to improve data safeguards;
• Establishing a council to provide ongoing advice on best practices and systems, including emerging technological management protocols;
• Having a technology advisor focus on security procedures and practices, along with reviewing data center operations, including assessing current technology, critical processes and existing infrastructure;
• Appropriate funds to beef up the IT department’s infrastructure;
• Develop and implement mandatory cybersecurity responsibility training;
• Conduct a forensic review of systems; and
• Create and deploy a team to assess the needs and support the implementation of immediate solutions.