Miami-Dade Teen Who DDoS’d Virtual School Got Probation While a $15.3 Million K12 Contract Was Never Fully Signed
MIAMI, FLORIDA — The only person Miami-Dade County ever put in front of a judge for the cyberattacks that wrecked the first week of pandemic school was a 16-year-old junior at South Miami Senior High. He admitted eight distributed-denial-of-service attacks. He told a judge it was a mistake. He received a year of probation and 30 hours of community service. The $15.3 million learning platform he helped knock over was never fully signed, the company behind it wrote a $1.57 million check to the superintendent’s foundation before the contract was executed, and the man who ran the district later left for Los Angeles and resigned there on June 21, 2026, while the FBI was looking at a different vendor deal entirely.
Those are four different facts. They share a building. Treating the teenager as the whole story is how a school district hides a purchasing failure inside a police blotter.
Eight attacks, and a name the public never got
Classes for the 2020-21 year opened on August 31 with more than 270,000 students pointed at a product called My School Online, sold by K12. Teachers could not log in. Rosters vanished. Parents filled the school board’s inbox. Miami-Dade Schools Police Chief Edwin Lopez said the district would not rest until everyone involved was caught and brought to justice. Superintendent Alberto Carvalho called it “disheartening that one of our own students has admitted to intentionally causing this kind of disruption.”
The student, then 16, was charged with using a computer in an attempt to defraud, a third-degree felony that can mean five years if a prosecutor moves the case to adult court, and with misdemeanor interference with an educational institution. His name stayed sealed because he was a minor. Detectives worked with the FBI, the Secret Service, and the Florida Department of Law Enforcement. The district said the servers were not breached and no student records were taken. Carvalho told the board that some of the traffic looked as if it came from Russia, Ukraine, China, and Iraq, and he also said a rented denial-of-service tool does not prove a foreign government was behind a teenager’s mouse.
A DDoS attack is a blunt instrument. It does not steal files. It hires or hijacks a crowd of machines and has them knock on one door until the door stops answering. Justin Cappos, a computer scientist at New York University who looked at the failure, pointed at outdated software and at capacity the district was already struggling to provide before any student pressed a button. Police later said the teenager orchestrated no fewer than eight of at least two dozen attacks that hit the opening days. Attacks continued after his arrest. So did the crashes that had nothing to do with him, including a Cisco switch the district blamed for the first morning and trouble on the Comcast side of the pipe.
On March 12, 2021, the student, by then 17 and no longer at South Miami Senior High, stood in front of Circuit Judge Yery Marrero. “All of this was a mistake,” he said. “I didn’t mean to cause harm.” Prosecutors never charged him as an adult. The Miami Herald reported the sentence: one year of probation, 30 hours of community service, no jail. A child who rented a tool the internet sells to bored people received the punishment the statute treats as a juvenile error. The adults who had bet the fourth-largest school district in the country on an unsigned contract received an inspector general’s memo.
The contract that was never finished
K12’s deal was a $15.3 million no-bid arrangement. Chief Financial Officer Ron Steiger told the board the system was failing while teachers were still trying to take attendance on it. Carvalho had not even fully executed the contract when the school year began. After a meeting that ran about 13 hours and drew some 400 speakers, the board killed the K12 platform in the early hours of September 10, 2020. Grades 6 through 12 went back to Zoom and Microsoft Teams. The universal online system the district had promised the county was gone before the second full week of school.
The check is the part that outlasted the outage. On the eve of the launch, with the contract still hanging, Carvalho solicited a donation from K12 for the Foundation for New Education Initiatives, the nonprofit he had started in 2008 when he was an assistant superintendent. K12 Florida, LLC sent $1.57 million. The money hit the foundation’s account on September 8, 2020, days before the board scrapped the product. The pitch was $100 gift cards for teachers who had been fighting the software on overtime. The Miami-Dade schools inspector general, Felix Jimenez, opened a review on September 16, 2020, file IG-20-0008-SI.
The final report, dated June 29, 2021, found no actual violation of the state ethics code or of school board conflict rules, and it did not accuse anyone of pocketing the money. It did say this, in the sentence that matters: “There is no doubt that this solicitation for gifts totaling over $1.5 million — on the eve of the temporary K12 LMS (learning management system) go-live and with an unsigned contract hanging over it — created an appearance of impropriety.” The inspector general told the foundation to give the money back. District spokeswoman Daisy Gonzalez-Diego said the report showed the actions were legal and aimed at students and teachers. In July 2021 the foundation kept the $1.57 million and said it would still reach teachers. K12, by then, had changed its name.
The company renamed itself. The superintendent changed cities.
K12 Inc. became Stride, Inc. in December 2020. The Florida subsidiary’s sole member was K12 Management, Inc., itself under Stride. Nathaniel Davis was the executive on the other end of the Miami-Dade relationship. The failed platform did not end the company. Stride kept selling virtual schooling in other states. The teenager’s probation clock ran out. The unsigned contract became a line in an inspector general PDF that almost nobody assigned in a civics class.
Carvalho left Miami-Dade in 2022 to run the Los Angeles Unified School District, the nation’s second-largest system. That job ended on a different scandal. On June 21, 2026, he resigned, effective the same day, after four months under FBI investigation tied to a collapsed artificial-intelligence chatbot venture with a company called AllHere. Agents had searched his district office and homes in San Pedro and in Florida. “Placing students first has always guided my work,” he wrote. “Because I believe our schools must remain focused on students and learning without distraction, I am resigning as Superintendent of LAUSD effective today, June 21, 2026.” The Los Angeles Times reported the departure. Three days later the board gave the permanent job to acting superintendent Andrés Chait. None of that is a prosecution for the 2020 denial-of-service attacks. It is the second time a Carvalho purchasing relationship with an education vendor blew up in public, and the second time the criminal file, if there is one, is not about the student who clicked the button.
The useful question is which failure was harder to commit. A junior with a downloadable stresser tool can darken a login page for an hour. A superintendent can point the fourth-largest school district in the country at software the board has not finished buying, collect a seven-figure donation from the seller for his own foundation, and still be the person who gets to call the student disheartening. Miami-Dade’s police chief promised the public that every attacker would be caught. The record shows one child, a probation term, and a platform that was already falling over from a Cisco switch, a capacity problem, and a contract nobody had signed.
Denial-of-service tools have only gotten cheaper since that week. School districts still sign emergency technology deals when a classroom has to move online overnight, and they still discover, afterward, that the emergency was also a sales opportunity. The AEGIS Alliance has tracked that pattern in later breach reporting and in the proxy networks that turn ordinary phones into traffic. The Miami-Dade week remains the cleanest local example of the split: the kid got a docket number, and the invoice survived.
Related from The AEGIS Alliance: the Key West 8-year-old, later cybercrime reporting, e U.S. News.
