After the investigation it disclosed by a report that confidential data of 2000 students leaked during the cyber attacks. Students psychological evaluation had been broadcasted on dark web were related to students born in late 1980’s and 1990’s.
To which the Los Angeles Unified School District (LAUSD), senior IT administrator Mr. Jack Kelanic admitted on Thursday that, in the September 2022 cyberattack data leak around 2,000 student assessment records were revealed. Out of which 60 records were pertaining to current enrolled students.
This data leak also included positive COVID-19 test results, driver’s license and Social Security numbers. The student assessment records included their psychological evaluations, medications, diagnoses, incidents of sexual abuse, home lives, past traumas and behavioral challenges. Some of the data included student attendance and academic data from 2013-16.
Mr. Jack Kelanic said that the information on the cyberattack has been made public “based on its availability at the time and as confirmed by both internal and external expert entities.” Kelanic reported that,” Some of these records go back almost three decades which creates further time-consuming analysis”. Los Angeles Unified takes student, family and employee privacy very seriously and has been implementing enhanced protections and procedures to ensure our data security”. He also said that, “As we continue to ascertain the accuracy and thoroughness of the data and follow protocols to conduct a comprehensive review, we have already notified some individuals and vendors who have been impacted by this attack and will continue notifying individuals as they are determined. The ongoing legal notification is complex and made harder in many instances due to the age of files.”
It is observed that cyber-attacks have gone worst post Covid-19 pandemic, wherein numerous students were forced to participate in online mode for virtual instruction in spite of the school’s technological system not being stable enough.
Initially, LAUSD Superintendent Mr. Alberto M. Carvalho refused to admit the severeness of the Cyber-attack and dispelled all the rumors of data leak of most confidential information related to students. On 1st October 2022, the Russian criminal syndicate Vice Society released the data on dark web after the school districts declined to negotiate for the ransom asked against 500 gigabytes of data that they hacked during the September 2022 Cyber-attack.
In fact, he justified himself by saying that, there may be some “outliners” or individual instances of sensitive data being released” he added that some independent contractors who must have applied for the contracts must have released small nos of W-9 tax forms information. After analyzing 2/3 of the leaked data, he said in an interview,” no evidence of widespread impact, as far as truly sensitive confidential information”. He was determined enough that the leak data did not include any kind of psychological evaluation.
President of Security Studio, Mr. Ryan Cloutier who is also an expert on K-12 cyber security says, “it could ruin careers, it could damage families, people could get fired, it could potentially increase the likelihood of self-harm if they suffer some kind of mental trauma from it.
Frankly most of us don’t want the dumb stuff we did as an angry moody teenager to be a permanent record for all the world to access”. He thinks it is the moral obligation of the school district to inform the parents of the students whose psychological evaluation were hacked on dark web.
Mr Kelanic said in his statement that,” throughout this process, information has been made public based on its availability at the time and as confirmed by both internal and external expert entities. Ongoing legal notification is complex and made harder in many instances due to the age of files” He also added,” The aftermath of a cyber-attack is a multi-layered, dynamic process in which real-time updates often alter the direction of an investigation.”
He hasn’t given any time-line as on when district had discovered about leak of the critically sensitive data. But has ensured that the school district has started informing the individuals and vendors suffered from the attack and will keep updating the others as the people are identified.
