Why LAUSD could keep classrooms open through a ransomware attack
The second-largest U.S. school district opened on schedule days after ransomware hit its systems. That was possible because classroom teaching depends on few systems. The hard parts were resetting access for an enormous population and telling families what to do.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
Over the Labor Day weekend, on Saturday, September 3, 2022, the Los Angeles Unified School District, the second-largest public school district in the United States, detected a ransomware attack on its information technology systems. The district brought in federal help, and the White House, the Department of Education, the FBI and CISA were involved in the response. District leaders decided to open schools as planned on Tuesday, September 6, while some systems remained disrupted. Staff and students were required to reset passwords, many employees in person at district sites. On September 6, CISA, the FBI and the Multi-State Information Sharing and Analysis Center published an advisory on the Vice Society group, which had disproportionately targeted education. Vice Society later claimed the attack, and the district said publicly that it would not pay.
Public agencies hit by ransomware rarely have the option of closing. Schools, courts, permit offices and benefits programs serve people with no alternative provider, and closing a large school district for a week disrupts hundreds of thousands of families. LAUSD’s decision to open on schedule was a bet that teaching could continue while technology was restored. The bet paid off because of a fact many continuity plans never write down: the core service depended on far fewer systems than the organization ran.
The response turned on three pieces of work, each owned by different people. The first was knowing which services needed which systems, so leaders could decide what to open. The second was restoring access safely for a very large workforce and student body. The third was telling families, staff and the press what was happening in a way that kept the doors open. Any city, county or state agency facing a similar incident would face the same three.
Knowing what each service needs
Classroom instruction needs a teacher, a room, students and, in most cases, very little else on the first day. Attendance can be taken on paper. Lesson plans exist offline. Many administrative systems, from payroll to facilities and procurement, can run on delay or by hand for a period. Other services sit closer to the line. Student safety requires knowing who is authorized to pick up a child and who has a medical condition. Meals require eligibility lists. Buses require routes and rosters.
A leadership team can only make the open-or-close call quickly if that mapping already exists. In practice it is a short table: each public-facing service, the systems it depends on, how long it can run without them, and the manual fallback. Building it takes a few weeks of interviews with service owners. It also usually reveals surprises, such as a safety-critical roster that lives only in an online system with no printed copy.
For other agencies, the same table belongs in the continuity plan, signed by the agency head rather than the IT department, because the decisions it supports are about service, not technology. It should be refreshed each year, since services move onto new platforms faster than plans are updated.
The table should also record which outside providers hold copies of the same data. Districts use hosted platforms for learning, transport routing, meals and family messaging, and some of those keep rosters that survive an attack on the district’s own network. Knowing which copies exist, and whether they can be trusted after an intrusion, can turn a manual fallback into a partial digital one. The same list tells responders which vendors to notify.
Restoring access for a whole population
After an intrusion, credentials may be compromised, so a mass password reset is standard. For a company of a few hundred people it is a help desk task. For a school district with tens of thousands of employees and far more students, it is a logistics operation with its own staffing, sites and schedule.
LAUSD chose in-person resets for many employees at district sites. That was slower and more frustrating than an online process, and it produced long lines. It was also more reliable when online systems might be compromised and identity had to be verified with confidence. The choice traded convenience for assurance, which was the right trade in the first days.
Planning that operation in advance changes its cost. A plan says how identity will be verified for staff and for students of different ages. It says where resets happen and in what order, and which roles go first, such as school leaders, nurses and transport staff. It also covers multi-factor enrollment, and how devices issued to students are checked before they reconnect. Organizations that already had phishing-resistant multi-factor authentication and verified self-service recovery face a much smaller job. For large public bodies, that pre-incident investment is mainly a way to avoid a reset line around the block.
The workforce strain extends beyond the reset. Technical staff at the center of a weeks-long incident work long hours under pressure. Agencies that planned shifts, brought in outside responders early and protected key people from burnout recovered more steadily.
Telling families and staff what to do
A district in a ransomware incident speaks to parents, students, employees, the press and elected officials at once. Saying too little feeds rumor. Saying too much can harm the investigation or overstate what is known. The core of good communication is plain and repetitive: what is open, what people need to do, what to avoid, and when the next update will come.
Families need instructions in the languages they use, through channels that do not depend on the affected systems. Staff need a one-page daily note on which systems to avoid, how to report problems and what to tell parents. That note alone can cut calls to an overloaded help desk.
Ransom payment is a policy choice that leaders should discuss with law enforcement and counsel in advance, together with what will be said publicly. LAUSD stated that it would not pay. A district that decides this under pressure, in the first hours, is more likely to change its position later.
With hindsight
After the district refused to pay, Vice Society published data it said it had taken, and the district later notified affected individuals. Ransomware against K-12 districts, cities and counties stayed frequent through 2023 and 2024, and several large municipal incidents caused weeks of service disruption. CISA published a report on K-12 cybersecurity in January 2023, and the State and Local Cybersecurity Grant Program, created by the 2021 infrastructure law, began funding improvements. Vice Society faded from view, with researchers tracking related activity under other names. By 2026, the LAUSD response is still a useful reference for public-sector leaders. Its value lies less in the technical details than in three operating habits: know what each service needs, plan mass access resets as logistics, and communicate plainly.