Thousands of students' health records leaked online after ransomware attack

A California school district announced Wednesday that a September ransomware attack caused thousands of students' health records and psychological assessments to be posted on the dark web, according to an investigation conducted by the 74.

The district estimated that the cyber attack leaked the sensitive records of 2,000 current and former students in the Los Angeles Unified School system, the nation's second-largest district.

The ransomware gang, Vice Society, hacked the district's system last year and demanded ransom payments for 500 gigabytes of stolen data. When the district refused to pay, the criminals released the students' confidential information online.

Four months ago, the district's superintendent, Alberto Carvalho, denied that students' psychological recorders were included in the leak.

On Wednesday, the school district admitted that the attack was worse than previously reported and noted that 60 current student records have been compromised. Private student information, including medical history, observations on their home and family life, and cognitive, academic, and emotional functioning assessments, were posted to the dark web.

The district did not attempt to correct Carvalho's previous statements but instead insisted that his claims "were based on the information that had been developed at that time."

"As the District and its partners delve deeper into the reality of the data breach, the scope of the attack further actualizes and new discoveries have been revealed," stated Jack Kelanic, the district's senior administrator of IT infrastructure. "Approximately 2,000 student assessment records have been confirmed as part of the attack, 60 of whom are currently enrolled, as well as Driver's License numbers and Social Security numbers."

According to the district, many leaked records were 30 years old. After reviewing 500 psychological evaluation forms, the 74 reported that the records primarily belonged to former students born in the late 1980s and the1990s.

The Los Angeles Daily News reported that the district is under no legal obligation to disclose the leaked psychological evaluation data because school documents are not protected under HIPAA but rather by the Family Educational Rights and Privacy Act, which does not require schools to report record breaches.

Kelanic told Reuters that some compromised information could include mental health, attendance, disciplinary, and academic records. COVID test results, driver's licenses, and Social Security numbers were also exposed.

District officials stated that the investigation is still ongoing, and they will continue to notify victims "as they are determined."

"Los Angeles Unified takes student, family and employee privacy very seriously and has been implementing enhanced protections and procedures to ensure our data security," Kelanic stated.

Like Blaze News? Bypass the censors, sign up for our newsletters, and get stories like this direct to your inbox. Sign up here!