Hackers released data from Los Angeles Unified School District on
Saturday, a day after Supt. Alberto Carvalho said he would not negotiate
with or pay a ransom to the criminal syndicate.

Some screenshots from the hack were reviewed by The Times and appear to
show some Social Security numbers. But the full extent of the release
remains unclear.

The release of data came two days earlier than the deadline set by the
syndicate that calls itself Vice Society � and happened in apparent
response to what it took as Carvalho�s final answer. Hackers demand ransom
to prevent the release of private information and also to receive
decryption keys to unlock computer systems.

�What I can tell you is that the demand � any demand � would be absurd,�
Carvalho told The Times on Friday. �But this level of demand was, quite
frankly, insulting. And we�re not about to enter into negotiations with
that type of entity.�

In a statement released later that day, he said: �Paying ransom never
guarantees the full recovery of data, and Los Angeles Unified believes
public dollars are better spent on our students rather than capitulating
to a nefarious and illicit crime syndicate.�

The extent of the data theft is now being evaluated by federal and local
authorities, including the school district.

�Unfortunately, as expected, data was recently released by a criminal
organization,� the school district said in a social media post Sunday. �In
partnership with law enforcement, our experts are analyzing the full
extent of this data release.�

Carvalho said on Friday that he believed confidential information of
employees was not stolen. He was less certain about information related to
students, which could include names, grades, course schedules,
disciplinary records and disability status.

Some of the documents in the release appear to be forms with confidential
information from the facilities services division. These forms could have
been filled out either by district employees or by contractors doing work
for the school system.

Some W-9 forms also appear to be in the release. The W-9 is an official
form furnished by the IRS for employers or other entities to verify the
name, address and tax identification number � typically a Social Security
number � of an individual receiving income. Independent contractors who do
work for companies or agencies they are not employed with must often
provide that entity a W-9.

The district will provide assistance to anyone harmed by the release of
data and has set up an �incident response� line at (855) 926-1129. Its
hours of operation are 6 a.m. to 3:30 p.m., Monday through Friday,
excluding major U.S. holidays.

Since the attack, which was discovered Sept. 3, the nation�s second-
largest school district has worked closely with local law enforcement, the
FBI and the federal Cybersecurity and Infrastructure Security Agency, or
CISA.

CISA posted a warning to education institutions about Vice Society
immediately after the LAUSD attack without directly confirming that the
syndicate was responsible for it.

The syndicate�s original Monday deadline was posted on the dark web site
maintained by Vice Society, which had informally confirmed to at least
three reporters that it was responsible for the hack.

https://www.latimes.com/california/story/2022-10-02/hackers-release-data-
ahead-of-deadline-in-response-to-lausd-refusal-to-pay-ransom