Why LAUSD could keep classrooms open through a ransomware attack

The week

On Saturday, September 3, 2022, the start of the Labor Day weekend, the Los Angeles Unified School District detected a ransomware attack on its information technology systems. LAUSD is the second-largest public school district in the United States. Its students, employees and contractors together outnumber the residents of many American cities, and almost all of them had district accounts.

Ransomware is malicious software that criminals slip into an organization’s network to scramble its files and systems so they cannot be used. The criminals then demand a ransom, usually in cryptocurrency, in exchange for a key to unscramble them. Increasingly they also copy data out first and threaten to publish it if they are not paid. It is extortion, carried out through a keyboard.

The timing was hard. The school year was already under way, so the attack landed in the first weeks of term rather than during the summer break. Superintendent Alberto Carvalho, who had joined the district earlier that year after leading the Miami-Dade schools, announced the attack publicly over the holiday weekend.

The district brought in federal help quickly. The White House, the Department of Education, the FBI and CISA, the Cybersecurity and Infrastructure Security Agency, were involved in the response. CISA is the federal body responsible for helping protect civilian networks. It works alongside the FBI, which leads the law enforcement side of a cyber investigation.

District leaders then made the decision that defined the week. They chose to open schools as planned on Tuesday, September 6, after the holiday, while some systems remained disrupted. According to press reports, the affected systems included email and parts of the district’s operational applications, among them platforms used for purchasing and facilities work. Students would be in classrooms even though parts of the district’s technology were still down.

The cleanup touched almost everyone. Staff and students were required to reset their district passwords in person at district sites, with an exception for students in online programs. Press reports put the number of accounts involved at more than 600,000. Because demand was heavy, the district staggered the resets by group, starting with teachers and administrators early in the day and moving to students later. Lines formed anyway.

A reset after an intrusion is a sensible precaution, because the attackers may have stolen login details. At the scale of this district it meant logistics and frustration. LAUSD had already been rolling out multi-factor authentication before the attack, with plans to require it for some access from outside the district network later in September. The incident turned a planned program into an urgent one.

On September 6, the same day schools opened, CISA, the FBI and the Multi-State Information Sharing and Analysis Center (MS-ISAC) published an advisory on the Vice Society group. MS-ISAC helps state and local governments share threat information. The advisory said the group had first appeared in the summer of 2021 and had disproportionately targeted education, especially K-12 schools. It warned that attacks might increase as the 2022-23 school year began. It observed that districts with limited cybersecurity capabilities and constrained resources were often the most vulnerable. And it noted that sensitive student data, reachable through school systems or the service providers that manage them, made schools attractive targets.

The advisory described a familiar playbook. Vice Society likely got in with stolen credentials or by exploiting internet-facing applications. It raised its privileges through the PrintNightmare flaw in the Windows print service, moved across networks with widely available attack tools, and stole data before encrypting anything. It used existing ransomware strains rather than its own. The recommended defenses were the basics: offline backups, phishing-resistant multi-factor authentication, network segmentation and prompt patching of known exploited flaws.

Vice Society later claimed the attack on LAUSD. The district said publicly that it would not pay and would not negotiate.

Behind the headlines sat a simple question that every public agency should be able to answer in advance: which of our services can keep running when our computers cannot, and what does it take to keep them going?

Suppose you are the superintendent of a school district serving hundreds of thousands of families. It is Saturday night of a holiday weekend. Your technology chief calls to say criminals are inside the network and some systems are already down. Schools open in three days. Parents are expecting to drop their children off on Tuesday morning; many of them have jobs that do not stop because the school district has a computer problem. What do you decide, and on what basis?

Public agencies hit by ransomware rarely have the option of closing. Schools, courts, permit offices and benefits programs serve people with no alternative provider, and closing a large school district for a week disrupts hundreds of thousands of families. LAUSD’s decision to open on schedule was a bet that teaching could continue while technology was restored. The bet paid off because of a fact many continuity plans never write down: the core service depended on far fewer systems than the organization ran.

Opening was also a risk, and the case against it deserves a fair hearing. Students and staff would arrive with laptops and tablets that might reconnect to a network still under investigation. Help desk staff needed for the reset would be pulled into classroom support. Every hour of normal activity created noise in the logs that investigators were reading. A district that closed for a few days could have argued, with some justice, that it was buying a cleaner recovery.

The answer to that argument is that the risks of opening could be managed separately from the decision to open. Devices could stay off the network until checked. Teaching could proceed on paper. The reset could be scheduled around the school day. Closing, by contrast, imposed its full cost on families at once and bought less time for investigators than it appeared to, because recovery from ransomware takes weeks, not days.

The response turned on three pieces of work, each owned by different people. The first was knowing which services needed which systems, so leaders could decide what to open. The second was restoring access safely for a very large workforce and student body. The third was telling families, staff and the press what was happening in a way that kept the doors open. Any city, county or state agency facing a similar incident would face the same three. First, though, what a ransomware attack actually does inside an organization.

How an attack unfolds inside the network

Most ransomware attacks follow a recognizable pattern. The criminals first get a foothold, often by tricking an employee into entering their password on a fake login page, a technique called phishing, or by using a password stolen elsewhere. Once inside, they move from system to system unnoticed, looking for administrator accounts that give them broad control. This stage can last days or weeks.

Next, many groups copy data out of the network. Then they trigger the encryption, scrambling files and servers so that they cannot be used. The ransom note follows: pay, and you will get a key to unlock your systems and a promise not to publish what we took. Refuse, and the data may be leaked online. This combination is often called double extortion.

Even if the organization gets its systems back on its own, the stolen data is still out there.

Why the playbook works so well against school districts

The federal advisory on Vice Society described the steps in that group’s version of the pattern. Each one maps onto a weakness common in K-12 networks.

• Getting in. Stolen credentials work because districts have huge numbers of accounts, many held by students and part-time staff, and passwords are reused across personal and school services.
• Raising privileges. PrintNightmare was a flaw in the Windows print service. Schools run print servers in nearly every building, and older ones are easy to forget when patches are scheduled.
• Moving sideways. Many district networks are flat, meaning a computer in one school can reach servers in the central office with few barriers in between.
• Taking control. Once attackers hold a domain administrator account, the master key to a Windows network, they can reach almost every system and account.

The last step explains much of what followed at LAUSD. When an attacker may have held administrator rights over the directory that manages accounts, no password in it can be trusted. That is why a mass reset follows, and why it has to cover service accounts used by software as well as people.

What the attack leaves behind

For a public agency, the practical consequences are threefold. Some systems stop working. Every password and account must be treated as possibly compromised. And there is a period, often weeks, when the agency must restore systems carefully, checking each one for hidden back doors before trusting it again. Responding well means keeping essential services running through all three.

Attackers also tend to spend time inside before striking. LAUSD later said the intruders had begun their reconnaissance around the end of July, roughly five weeks before the encryption. That gap matters for recovery. A backup taken during those weeks may contain whatever the attackers planted, so the restore point has to be chosen with the investigation’s findings in hand.

Knowing what each service needs

Classroom instruction needs a teacher, a room, students and, in most cases, very little else on the first day. Attendance can be taken on paper. Lesson plans exist offline. Many administrative systems, from payroll to facilities and procurement, can run on delay or by hand for a period. Other services lie closer to the line. Student safety requires knowing who is authorized to pick up a child and who has a medical condition. Meals require eligibility lists. Buses require routes and rosters.

A leadership team can only make the open-or-close call quickly if that mapping already exists. It is usually a short table: each public-facing service, the systems it depends on, how long it can run without them, and the manual fallback. Building it takes a few weeks of interviews with service owners. It also usually reveals surprises, such as a safety-critical roster that lives only in an online system with no printed copy.

For a typical district, such a table might read as follows. Classroom teaching: depends on almost nothing digital on day one; fallback is paper attendance and printed plans; can run for weeks. School meals: depend on eligibility lists in a nutrition system; fallback is a printed list refreshed each term, or serving everyone for a short period; can run for days. Student pickup and medical information: depends on the student information system; fallback is a printed, locked binder in each school office; must be available from the first hour. Payroll: depends on a finance system; fallback is repeating the previous pay run; can run for one or two cycles. Seen this way, the decision to open becomes a matter of checking a handful of rows, not a leap of faith.

Three tiers of urgency

A useful way to sort the table is into three tiers. Safety-critical services must work from the first hour: pickup authorizations, medical alerts, emergency contacts, custody restrictions and the ability to reach families in an emergency. Time-critical services must work within days: meals, transport, payroll, and anything tied to a legal deadline. Deferrable services can wait weeks: purchasing, facilities requests, most reporting and analytics.

Legal deadlines deserve their own column. Special education is the clearest case. The federal Individuals with Disabilities Education Act sets timelines for evaluations and for meetings about each student’s individualized education program, and a ransomware attack does not suspend them. A district that cannot reach those records needs a plan for meeting or documenting the timelines anyway, worked out with counsel and its special education staff.

Meals show how policy changes the fallback. California began offering free school meals to all students from the 2022-23 school year, which removed the need to check eligibility at the serving line. Districts there still had to count meals for reimbursement, so the fallback became a paper tally rather than a printed eligibility list. A district in a state without universal meals faces a harder trade-off between feeding every child for a few days and recovering the cost later.

The hidden cost of each fallback

Every fallback has a price that should be written down beside it. Repeating the last payroll run keeps people paid, but it pays staff who have left and misses those who joined, and each error has to be reconciled later. Paper attendance keeps classes running, but someone must key it back in, and attendance drives state funding formulas in many states. Printed binders of medical information protect children, but they are themselves sensitive records that must be locked, refreshed and destroyed on schedule.

For other agencies, the same table belongs in the continuity plan, signed by the agency head rather than the IT department, because the decisions it supports are about service, not technology. It should be refreshed each year, since services move onto new platforms faster than plans are updated.

The table should also record which outside providers hold copies of the same data. Districts use hosted platforms for learning, transport routing, meals and family messaging, and some of those keep rosters that survive an attack on the district’s own network. “Hosted” means the software runs on the vendor’s computers rather than the district’s, so an attack on the district may leave it untouched. Knowing which copies exist, and whether they can be trusted after an intrusion, can turn a manual fallback into a partial digital one. The same list tells responders which vendors to notify.

Those copies cut both ways. A vendor that holds data from many districts is a single point of exposure for all of them, as the sector learned when a major student information vendor was breached in late 2024. The dependency table should therefore record two things for each hosted service: whether it can serve as a fallback, and what the district would do if that vendor were the one under attack.

Restoring access for a whole population

After an intrusion, credentials may be compromised, so a mass password reset is standard. For a company of a few hundred people it is a help desk task. For a school district with tens of thousands of employees and far more students, it is a logistics operation with its own staffing, sites and schedule.

LAUSD chose in-person resets for many employees at district sites. That was slower and more frustrating than an online process, and it produced long lines. It was also more reliable when online systems might be compromised and identity had to be verified with confidence. The choice traded convenience for assurance, which was the right trade in the first days. If the attackers might be watching the online reset process, the safest way to prove you are you is to show up with a badge.

Sequencing the reset

Order matters as much as speed. The technical team should reset administrator accounts first, because those are the keys an attacker most wants back. In a Windows domain, standard recovery guidance also calls for resetting the special account that signs login tickets, twice, so that any forged tickets the attackers created stop working. Service accounts, the non-human accounts that let one system talk to another, come next.

Service accounts are where resets break things. The student information system may feed the transport router, the nutrition system and the learning platform through accounts whose passwords are stored in configuration files. Change the password without updating every integration and the bus rosters stop refreshing. A list of service accounts, what uses each one and who can update it is dull to maintain and invaluable on the day.

People come last, and in priority order. LAUSD started with teachers and administrators. A fuller plan would also put school nurses, safety staff, transport dispatchers and payroll operators near the front, since their work maps to the safety-critical and time-critical tiers.

Students are not one population

Students need different handling by age. A high school student can enroll a phone app for multi-factor authentication, though not every student has a phone. A kindergartner often signs in with a printed badge or a simple code managed by the teacher. For younger children, the reset therefore runs through classroom teachers, not the help desk, and the plan should give teachers the materials and instructions to do it in one lesson.

Shared devices add another step. A cart of tablets used by several classes may have cached credentials or locally stored files. Checking and reimaging those devices before they reconnect is slow, and the plan should say which devices go first.

Verifying identity without creating a new weakness

Planning that operation in advance changes its cost. A plan says how identity will be verified for staff and for students of different ages. It says where resets happen and in what order. It also covers multi-factor enrollment, and how devices issued to students are checked before they reconnect.

The help desk is itself a target during a reset. Attackers who know an organization is resetting thousands of accounts can call in, posing as a stressed employee, and ask for a new password. The widely reported attack on MGM Resorts in September 2023 was said to have begun with a call to the IT help desk. During a mass reset, no password should be issued over the phone without a verification step the caller cannot fake. A call back to a number already on file is one such step.

Multi-factor authentication means logging in with something beyond a password, such as a code from a phone app or a physical security key. “Phishing-resistant” versions, like security keys, cannot be tricked into working on a fake website, which closes off the most common way attackers get in. Organizations that already had phishing-resistant multi-factor authentication and verified self-service recovery face a much smaller job. For large public bodies, that pre-incident investment is mainly a way to avoid a reset line around the block.

The trade-off is cost and friction. Security keys cost money per person and get lost. Phone apps assume every staff member will use a personal device for work, which some employee groups resist. Many districts settle on stronger methods for administrators and staff with access to sensitive records, and simpler methods for students, and that is a defensible line if it is drawn deliberately.

The workforce strain extends beyond the reset. Technical staff at the center of a weeks-long incident work long hours under pressure. Agencies that planned shifts, brought in outside responders early and protected key people from burnout recovered more steadily.

Telling families and staff what to do

A district in a ransomware incident speaks to parents, students, employees, the press and elected officials at once. Saying too little feeds rumor. Saying too much can harm the investigation or overstate what is known. The core of good communication is plain and repetitive: what is open, what people need to do, what to avoid, and when the next update will come.

Families need instructions in the languages they use, through channels that do not depend on the affected systems. If the district’s email platform is down or untrusted, a message sent through it will not arrive, or worse, will invite confusion with fraudulent messages. Text messaging services run by outside providers, local media, school signage and the district’s social media accounts become the backbone. Staff need a one-page daily note on which systems to avoid, how to report problems and what to tell parents. That note alone can cut calls to an overloaded help desk.

Expect a wave of fraud

A public ransomware incident is an invitation to fraudsters. Fake messages appear, telling parents or staff to reset their passwords through a link, or to update bank details for payroll. The best defense is a short rule repeated in every update: the district will never ask for a password or bank details by email or text, and resets happen only in person or through the named process. Payroll changes during the incident should require a second check through a known contact.

Different audiences, different owners

Each audience needs an owner. The communications office handles families and the press. Human resources and labor relations handle employees and their unions, who will ask about pay, personal data and extra hours. The board office handles elected members, who will be fielding calls from constituents and should not learn new facts from the news. Principals need a script, because parents will ask them first at the school gate.

A fixed cadence reduces pressure on all of them. A daily update at a set time, even when little has changed, stops people refreshing the website and calling the help desk. It also gives investigators a predictable window to clear what can be said.

The ransom decision

Ransom payment is a policy choice that leaders should discuss with law enforcement and counsel in advance, together with what will be said publicly. LAUSD stated that it would not pay. A district that decides this under pressure, in the first hours, is more likely to change its position later. Deciding in calm conditions also lets leaders weigh the considerations properly: whether payment would even restore systems, the legal and sanctions questions that can attach to paying some groups, and how a public body explains its choice to the community it serves.

The sanctions question is concrete. The Treasury Department’s Office of Foreign Assets Control issued an updated advisory in September 2021 on the sanctions risks of facilitating ransomware payments. It warned that paying a sanctioned person or group can violate U.S. law, and said it would weigh prompt reporting to law enforcement and cooperation as mitigating factors.

Insurance adds another party. Many school districts and local governments buy cyber coverage, often through public-entity risk pools. Policies commonly name the forensic firms and lawyers the insurer will pay for, and may require notice within a set time. A district that learns these terms during the incident loses hours it does not have. The policy, the panel of approved firms and the notice requirements belong in the incident plan, with a named person who calls the insurer.

How recovery unfolds after the first day

Opening the doors is the most visible decision, but it is the start of the work, not the end. Recovery from ransomware tends to run in overlapping phases, and leaders who understand them can set realistic expectations with staff and the public.

The first phase is containment: cutting off the attackers’ access, often by disconnecting systems from the network, disabling compromised accounts and resetting passwords. This is when the help desk lines form. The second phase is investigation: working out how the attackers got in, where they went and what they took. Outside responders and federal partners usually lead or support this, and its findings shape everything after. The third phase is restoration: bringing systems back one by one, from clean backups where possible, and checking each for hidden access before reconnecting it. The fourth is hardening: fixing whatever let the attackers in and raising defenses so the same path cannot be used again.

These phases overlap, and they take weeks. A district that tells families “everything will be back to normal on Friday” is likely to have to correct itself. A district that says “classes are running; some online services will return over the coming weeks, and we will tell you each time one does” sets an expectation it can meet.

Restoring in order of dependency

Systems come back in the order the others depend on them. Identity comes first, because almost every other system checks logins against it. Core network services, such as name resolution and time, come next. Then come the systems that carry the safety-critical and time-critical tiers: the student information system, family messaging, nutrition, transport and payroll. Purchasing, facilities and reporting can wait.

For each system the team chooses between restoring from backup and rebuilding from scratch. Restoring is faster but carries whatever the backup contains. Rebuilding is slower but cleaner. For identity and other systems an attacker controlled, rebuilding is often the safer choice, and the plan should say so in advance.

Evidence versus speed

Investigators want systems preserved as they were found. Operators want them wiped and restored. Both are right. The usual compromise is to capture images of affected machines before rebuilding them, which costs storage and hours but keeps the evidence needed to answer what was taken. That answer drives the notification work described in the next section, so skipping it to save a day can cost months later.

What leaders should track

A small set of measures keeps leaders honest about progress: accounts reset as a share of the total, systems restored against the priority list, help desk queue length and waiting time, and open questions from the investigation. Reporting the same measures each day, publicly where possible, builds trust that the district knows where it stands.

Backups deserve a special mention. A backup is only useful in a ransomware attack if the attackers could not reach it. Copies stored on the same network, with the same administrator passwords, are often encrypted or deleted along with everything else. Keeping at least one copy offline or in a separately protected location, and testing that it can actually be restored, is among the most valuable investments a public body can make.

Planning for the data as well as the systems

Modern ransomware groups lock systems and also take copies of data, threatening to publish them. That gives an incident a second timeline, separate from getting systems back.

For a school district, the data at stake can include student records, staff personnel files and health information. Preparing for a leak means knowing in advance where sensitive records live, who would assess what was taken, and how affected people would be notified under the rules that apply. It also means deciding how the district would respond if stolen material appeared online, including how it would support families and staff worried about what was exposed. Agencies that have mapped their sensitive data can answer these questions in days. Those that have not may spend months reconstructing what was where.

Sensitive data lives in unexpected places

LAUSD’s own experience shows why the map has to go beyond the obvious systems. Months after the attack, the district disclosed that stolen files included labor compliance records submitted by construction contractors, with names and Social Security numbers of contractor staff. Public works rules generate that kind of paperwork, and it tends to collect in a facilities division’s file shares, far from the systems a privacy team watches.

The same is true of student data. Psychological evaluations, disciplinary files and special education assessments are often stored as documents on shared drives as well as in purpose-built systems. A data map that lists only the student information system misses them.

Which rules apply

The rules are a patchwork, and districts should work through them with counsel before an incident. FERPA, the federal law on student education records, governs who may see those records, but it does not contain a general breach notification requirement of the kind found in many state laws. State breach notification laws vary in whether and how they reach school districts and other local public bodies. Health information held by a school nurse is generally an education record under FERPA rather than a HIPAA matter, which surprises many people. Contractor and employee data brings in yet other rules.

Keeping less

The cheapest data to protect is data the district no longer holds. Records schedules exist for this reason, but many organizations keep files long after the schedule allows, because deleting feels risky and nobody owns the task. A retention review that removes old assessments, closed personnel files and expired contractor records shrinks what an attacker can take. It needs a named owner and an annual date.

Jails, courts and benefits offices face the same call

LAUSD is a school district, but the pattern applies to any organization that delivers an essential service. A county that runs a jail, a court that schedules hearings, a state agency that pays benefits, a hospital that admits patients: each must decide, in the first hours of an incident, what to keep open and how.

The costs of getting that wrong are tangible. Closing unnecessarily disrupts the people the agency exists to serve, and for a school district that means working parents scrambling for childcare and children missing meals they rely on. Staying open without the right fallbacks creates safety risks, such as a child released to the wrong adult. A chaotic password reset costs days of lost productivity across a vast workforce. Confused communication erodes public trust at exactly the moment the agency needs it. And elected officials, auditors and the press will ask afterward what the plan was.

How the details differ by agency

The three pieces of work stay the same, but the details change with the service and the rules around it.

• County jails and sheriffs. Booking, release dates and medication schedules are safety-critical. Systems that touch criminal justice information fall under the FBI’s CJIS Security Policy, so restored systems and new access methods must still meet its authentication and audit rules.
• Courts. Filing deadlines are often set by statute or rule. Courts generally have ways to extend or excuse deadlines in an emergency, but the order has to be issued and published, which means the communications plan must reach lawyers as well as the public.
• Benefits agencies. Payments often run through outside processors. If the processor is unaffected, benefits can keep flowing while the agency’s own case systems are down, provided someone can approve new cases and changes by hand.
• Hospitals. Clinical care has well-developed downtime procedures, and HIPAA governs patient data. The weak points tend to be the administrative systems that clinicians do not think of as clinical, such as staffing and supply ordering.

Small agencies and large ones

Size changes the economics more than the method. A large district or county can afford a security team, a retained incident responder and a rehearsed plan. A small rural district may have one or two IT staff and no one on call over a holiday weekend. For smaller bodies, the realistic plan leans on outside help arranged in advance: a state or regional service, a risk pool’s incident response benefit, or a shared-services agreement with a larger neighbor. The dependency table and printed safety lists cost almost nothing at any size.

What prepared agencies had in place

• A signed service-dependency table. The agency head, rather than IT alone, owns the list of services, their systems, their tolerance for downtime and their fallbacks.
• Offline copies of what keeps people safe. Pickup authorizations, medical needs and emergency contacts exist on paper or in a trusted outside system.
• A reset plan as logistics. Sites, staffing, verification methods and priority roles are decided before anyone needs them, along with a list of service accounts and the integrations each one supports.
• Strong login protection already in place. Phishing-resistant multi-factor authentication shrinks both the chance of an attack and the size of the cleanup.
• Communication channels that survive. Pre-drafted, multilingual messages can go out through systems the attack cannot touch.
• Backups the attackers cannot reach. At least one copy is offline or separately protected, and restores are tested on a schedule.
• Insurance and outside help lined up. The policy terms, approved responders and notice requirements are in the plan, with a named person to make the call.

An auditor or state oversight body reviewing that preparation would ask for evidence, not intentions. The list is short. It covers the signed table and the date it was last reviewed, and the most recent restore test and its result. It adds the tabletop exercise report with the actions it produced, and the share of staff accounts protected by multi-factor authentication. Those four documents tell a governing board more about readiness than any policy statement.

Unprepared agencies show the same gaps. Continuity plans list systems but not services, so they cannot tell leaders whether a school or office can open. Safety-critical information exists only online. Password resets are improvised, with no thought to who goes first. Ransom policy is debated for the first time at two in the morning. And communication stops while leaders wait for certainty, leaving rumor to fill the gap.

Fallbacks, resets, ransom and outreach to settle in advance

These five questions test whether an agency could make LAUSD’s call on a holiday weekend with confidence.

• For each service the public depends on, which systems does it need, how long can it run without them, and what is the manual fallback?
• Where would we find, with every system down, the information that keeps people physically safe?
• If we had to reset every password tomorrow, where, in what order and with what proof of identity would we do it?
• Have we agreed our position on paying a ransom with law enforcement and counsel, and what we would say publicly?
• How would we reach families, residents or customers if our email and website were down?

With hindsight

The story did not end when classes began. The district later said the intruders had begun their reconnaissance around July 31, 2022, and that files were accessed and copied between then and September 3. The attack that surfaced on a holiday weekend had been under way for about five weeks.

After the district refused to pay, Vice Society published data it said it had taken, around the start of October 2022 and ahead of its own deadline. The district confirmed the leak. Later reporting, citing the district, said assessment records of roughly 2,000 current and former students had been exposed, some of them including mental health information. In early 2023 the district notified a further group: contractor staff whose Social Security numbers were in labor compliance records submitted for facilities projects.

That is the second half of double extortion. Refusing the ransom can restore control of systems but does not undo the theft of data, and the data timeline ran for months after the systems timeline had largely closed. The contractor records also showed that sensitive data had been sitting well outside the systems most people would have checked first.

LAUSD was not an isolated case. Ransomware against K-12 districts, cities and counties stayed frequent through 2023 and 2024, and several large municipal incidents caused weeks of service disruption. In 2023, the Medusa group attacked Minneapolis Public Schools and posted data after the district declined to pay. For residents and families, incidents like these meant delays in services they could not get anywhere else, the very situation that makes continuity planning in public bodies so important.

Vendor concentration became the next problem. In December 2024 PowerSchool, a widely used provider of student information systems, discovered a breach in which data on very large numbers of students and teachers across thousands of districts was taken. A Massachusetts student later pleaded guilty to federal charges over it. The episode showed that the hosted copies of rosters that help a district survive an attack on its own network are themselves a shared exposure.

The federal response grew more structured. Under the K-12 Cybersecurity Act of 2021, CISA published a report on K-12 cybersecurity in January 2023. Its first priorities were the basics this article describes: multi-factor authentication, patching known exploited vulnerabilities, tested backups, an incident response plan and training. In August 2023 the White House held a summit on school cybersecurity. At it, the Federal Communications Commission proposed a pilot program, adopted in June 2024, offering up to $200 million over three years for school and library cybersecurity.

The State and Local Cybersecurity Grant Program, created by the 2021 infrastructure law, opened its first funding round in September 2022, days after the LAUSD attack. It set out $1 billion over four years, with most funds required to flow to local governments. For state and local leaders, that meant both clearer guidance and some money to act on it, often for exactly the basics described here: stronger login protection, better backups and incident planning.

Vice Society faded from view. The group stopped posting to its leak site in mid-2023, and researchers at Check Point linked its operators, with medium confidence, to a newer operation called Rhysida, which also focused heavily on education. CISA and the FBI issued an advisory on Rhysida in November 2023. Rebranding of this kind is common in the ransomware economy, where groups split, rename and reform. It is a reason to plan for the pattern of an attack rather than for any one group.

What held up from the LAUSD response was the decision to open, the refusal to pay and the in-person reset. Each looked costly at the time and each proved defensible. What did not hold up was any assumption that the incident would be over once systems returned. The data consequences outlasted the outage by months.

By 2026, the LAUSD response is still a useful reference for public-sector leaders. Its value lies less in the technical details than in three operating habits: know what each service needs, plan mass access resets as logistics, and communicate plainly. They require no advanced technology, only someone senior to decide, before the call comes on a holiday weekend, that they are worth doing.