databreaches.net 4/19/2026, 6:10:42 PM · via preferred

LA schools probe fraudulent tax returns after Rhysida breach

CyberSIXT Evidence Panel Source marked as original reporting
Threat Actor
Rhysida

THE Los Angeles County Office of Education is investigating the possibility that fraudulent tax return filings were submitted in employees’ names after some school staff received letters indicating tax filings had been fraudulent, according to the Los Angeles County Office of Education.

The Southern California News Group confirmed that employees at two school districts were impacted, but the full scope remains unclear; LACOE manages payroll services for more than 150,000 employees across 100 school districts, community colleges and charter schools in Los Angeles County. The Los Angeles and Long Beach unified school districts say they do not use LACOE’s portal for electronic tax documents and their staff were not affected.

DataBreaches[.]net notes that Bellflower Unified School District was added to the Rhysida gang’s dark web leak site on 28 October 2025, with attackers claiming to have exfiltrated 4.5 TB of data comprising 2,322,764 files, including W-2 and other tax-related information; however, this does not prove that Bellflower’s data is involved in the reports of fraudulent tax filings, as Dysruption Hub reported in March. Read more at Los Angeles Daily News.

View full article

Article by CyberSIXT