The Los Angeles Unified School District was attacked over the Labor Day weekend of 3 September 2022 by the operation known as Vice Society. Reporting places the intruders in the network from 31 July, giving a dwell of around five weeks.
The district declined to pay, stating that paying never guarantees recovery and that public money was better spent on students. The group published what it described as 500GB. Reported contents include social security numbers, passport information, tax and legal documents, financial records with bank details, health information and student psychological assessments.
The Refusal Was Correct And It Was Not Free
The district’s reasoning is the reasoning this corpus consistently endorses: payment buys a promise from a party whose business is breaking promises, and the corpus has recorded enough re-extortion to treat the purchase as unreliable.
The cost was paid by the people in the files. We have recorded the identical structure at 22-1024, where an insurer refused and its customers’ medical claims were sorted and published, and at 22-0508, where a state refused and its importers waited. The decision is defensible every time and the person absorbing it is never the person making it.
Children Cannot Act On A Notification
The standard remedy catalogue assumes an adult who can freeze a credit file, watch for fraudulent accounts and change a password. A student cannot do any of it, and in many cases neither the student nor the family will learn of the exposure in a form they can act on.
We have argued at 25-1031 and 26-0726 that the remedies are poorly matched to the harm. Here they are unavailable rather than merely mismatched, and a psychological assessment published under a child’s name has no remedy at any age.
A District Is Not A Company
A school district cannot decline the population it serves, cannot price security into a product, and competes for budget against teaching. Its data holdings are nonetheless comparable to a mid-sized enterprise, and include categories most enterprises never touch.
We filed the same mismatch at 22-0118, where a humanitarian organisation held a uniquely dangerous register, and at 26-0728, where infrastructure operators were told to plan for degraded operation. Public bodies are asked to hold the most sensitive data with the least discretionary budget.
Built on contemporaneous reporting and on the district’s own public statements. The 3 September 2022 attack, the reported intrusion window from 31 July, the district’s stated refusal and its reasoning, the ~500GB figure claimed by the group, and the reported categories of published data are as reported. The 500GB volume is the operation’s own claim and is carried as a claim. This desk has not accessed the published data and will not; category descriptions come from reporting. No student, family or staff member is identified. Graded high. Corrections: corrections@forensicpost.com.