Thousands of LAUSD student, employee passwords must be changed after cyberattack

Federal, state and local authorities are continuing their investigation Wednesday into the weekend cyber attack on the Los Angeles Unified School District's computer systems that led the district to order teachers, staff and thousands of students to change their district passwords.

On Wednesday, LAUSD tweeted an update on the investigation into the hack, saying they have an "all-hands-on-deck" approach to addressing abnormal network activity. 

LAUSD targeted by ransomware attack, computer systems impacted in the district's technology systems over the weekend, disrupting some of its computer systems, including email, district officials said. It was confirmed as an external cyberattack Monday. Critical business systems, employee healthcare, or payroll were not impacted, and campuses were opened as scheduled Tuesday.

However, after the pandemic shifted so many student and staff communications online, a cyberattack is a major disruption to systems like teacher lesson plans.

"While we do not expect major technical issues that will prevent Los Angeles Unified from providing instruction and transportation, food or Beyond the Bell services, business operations may be delayed or modified," a statement from the district said. "Based on a preliminary analysis of critical business systems, employee healthcare and payroll are not impacted, nor has the cyber incident impacted safety and emergency mechanisms in place at schools."

According to the district, students and employees will have to reset their passwords at a district site. The district has established a schedule for different groups of students and employees to minimize wait times.

• 7 a.m. — administrators/teachers
• 9 a.m. — support staff
• 10 a.m. — high school students
• 11 a.m. — elementary/middle school students

No one appears to have taken credit for the cyberattack. It appears to be criminal in nature, district officials said, and the FBI and Department of Homeland Security's Cybersecurity and Infrastructure Security Agency are looking into it.