[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Data Breaches](/category/data-breaches) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [How Did LAUSD Get Hacked in 2022?](/blog/how-did-lausd-get-hacked) Publish date November 19, 2024 {x} minute read # How Did LAUSD Get Hacked in 2022? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) Vice Society, the cybercriminal gang responsible for the attack, is believed to have used internal login credentials leaked on the dark web to access LAUSD’s network and launch the ransomware attack. Twenty-three[ internal LAUSD credentials were leaked](https://www.databreachtoday.com/la-school-district-accounts-on-dark-web-before-attack-a-20008) on the dark web leading up to the attack, with at least one set granting access to LAUSD’s Virtual Private Network (VPN). Gaining access to a target’s VPN is usually the initial phase of a ransomware attack since these solutions are gateways to other sensitive network regions where malware can be installed. ## How did the LAUSD Ransomware Attack Happen? On September 3, 2022, the [Los Angeles Unified School District](https://www.upguard.com/security-report/los-angeles-unified-school-district) (LAUSD) fell victim to a ransomware attack launched by a Russian-speaking ransomware gang known as VIce Society. Vice Society didn’t immediately reveal the true impact of the attack, and without any evidence at the time to confirm otherwise, Superintendent Alberto Carvalho made an idealistic announcement that any accessed data most likely didn’t include personally identifiable information. Two weeks later, the hackers issued a ransom demand with a three-day ultimatum. At the time, the impact of the attack was still unknown. The offer in the ransom demand was likely the reversal of critical system encryptions caused by the attack. > During a single-extortion ransomware attack, hackers encrypt critical systems and only offer to reinstate system access if a ransom is paid. LAUSD, however, is a double-extortion ransomware gang, meaning that as well as encrypting critical computer systems, the group steals sensitive data and threatens to sell it if a ransom isn’t paid. These tactics pressure victims into making a ransom payment on two fronts: 1. The longer critical systems remain encrypted, the longer a business is unable to operate - which could result in SLA violations. 2. If sensitive customer data is leaked, a business could suffer enormous reputational damage. In this instance, it appears like Vice Society didn’t make its second extorsion threat clear in its ransom demand. LAUSD, rightfully[ following the FBI’s strict no-ransom payment ](https://www.fbi.gov/how-we-can-help-you/safety-resources/scams-and-safety/common-scams-and-crimes/ransomware)advice, denied the ransom payment, resulting in Vice Society publishing the stolen data on their ransomware leak blog hosted on the dark web. This data leak finally proved that sensitive data was stolen during the attack, highlighting the connection between[ ransomware attacks and data breaches](https://www.upguard.com/blog/ransomware-attacks-vs-data-breaches). Vice Society revealed to[ Bleeping Computer](https://www.bleepingcomputer.com/news/security/ransomware-gang-leaks-data-stolen-from-lausd-school-system/) that 500GB of data was stolen from LAUSD’s systems, which may include Social Security Numbers, Passport data, and other sensitive information. > Vice Society is known for targeting the education sector [Learn how to reduce the impact of ransomware attacks >](https://www.upguard.com/blog/protecting-employee-credentials-from-ransomware-compromise) The incident has escalated to the point of requiring assistance from the FBI, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency, and local law enforcement. ### Not the First Ransomware Attempt This isn’t the first time LAUSD was targeted by Vice Society. In 2021, the ransomware gang infected a computer belonging to the school’s psychologist with Trickbot - malware designed to steal credentials and financial information. Security firm, Hold Security, advised LAUSD of the attack, but it's unclear if the specific vulnerabilities that facilitated that attack were addressed. ## 2 Key Lessons from the LAUSD Hack Two important lessons can be learned from this attack. By applying them to your current cybersecurity program, your business could significantly minimize the impact or completely prevent a security incident like the LAUSD hack. ## 1. Implement a Data Leak Service A data leak detection service notifies a business when its sensitive data has been leaked on the dark web so that compromised accounts can be rapidly secured. The rapid remediation response that’s possible with such a service decrease the chances of compromised accounts being targeted in follow-up attacks. Such a service might have helped LAUSD detect and secure the leaked internal credentials that likely facilitated this ransomware attack. [Request a free demo of UpGuard’s data leak detection service.](https://www.upguard.com/demo) ## 2. Enforce MFA Across all Corporate Accounts In response to the attack, LAUSD announced the accelerated rollout of Multi-Factor Authentication (MFA) on all corporate accounts. MFA inserts additional identity verification steps within a login process, making it difficult for hackers to log into a network even with stolen credentials. However, [MFA can be exploited](https://www.upguard.com/blog/what-caused-the-uber-data-breach); so if you implement this security control, ensure you account for all[ common bypass methods](https://www.upguard.com/blog/how-hackers-can-bypass-mfa).\ ‍ See how your organization's security posture compares to LAUSD's. [View LAUSD's security report.](https://www.upguard.com/security-report/los-angeles-unified-school-district) ‍ ‍ ### Learn about other Famous Data Breaches: * [What Caused the Optus Data Breach?](https://www.upguard.com/blog/how-did-the-optus-data-breach-happen) * [What Caused the Medibank Data Breach?](https://www.upguard.com/blog/what-caused-the-medibank-data-breach) * [What Caused the Uber Data Breach?](https://www.upguard.com/blog/what-caused-the-uber-data-breach)[\ ](https://www.upguard.com/team/edward-kost) eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [How to Prevent Data Breaches in 2026 (Highly Effective Strategy)](/blog/prevent-data-breaches) Learn how to implement an effective security control strategy for defending against data breaches in 2026. [](/team/edward-kost) [Edward Kost](#) October 26, 2026 Attack Surface Management #### [Attack Surface Management Vendors Compared](/blog/attack-surface-management-vendors-compared) We compared ASM vendors and helped you rate them before agreeing to a POC! [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Attack Surface Management #### [The Blind Spot in Brand Protection: Why App Stores Slip Past Standard Monitoring](/blog/the-blind-spot-in-brand-protection-why-app-stores-slip-past-standard-monitoring) Do Brand Protection Solutions scan the Apple App Store and Google Play? Don't wait to find out. [](/team/lance-turner) [Lance Turner](#) September 22, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)