Vice Society ransomware gang steals contractors’ information from LAUSD

Los Angeles Unified School District (LAUSD), US’ second-largest school district that enrolls more than 640,000 students from kindergarten through 12th grade, disclosed that the ransomware gang Vice Society has stolen files containing labor compliance documents and contractors’ personal information, including names, home addresses, payroll records, and Social Security Numbers (SSNs).

During the ongoing investigation, LAUSD determined that the threat actors were active in its network for more than two months, between July 31 and September 3, 2022. According to data breach notification letters sent to affected individuals, the unauthorized actor accessed and acquired certain files stored on the school district’s servers during the two-month-long security breach.

Certified payroll records provided by contractors to LA Unified as part of Facilities Services Division projects are included in the labor compliance documents, which also contain names, addresses, and Social Security numbers of contractors, subcontractor employees, and other affiliated individuals.

Due to the exposure of Social Security numbers and other sensitive personal information, those affected by the data breach were advised to immediately freeze their credit to prevent fraud and identity theft. LAUSD will provide contractors and their employees with a one-year complimentary membership to Experian’s IdentityWorksSM, which will aid in the detection of data misuse.

Notably, the news comes after LAUSD Superintendent Alberto M. Carvalho confirmed in October last year that Vice Society published the stolen data on its leak site and announced that its experts and law enforcement had begun analyzing the leak’s impact. The ransomware gang leaked LAUSD data after the school district stated that it would not pay the cybercriminals’ ransom demands and that the money would be better spent on its students and their education.