A hacker has stolen personal information from millions of California students by breaching a system managed by an educational testing contractor.
State officials are now notifying affected families and providing identity protection services.
The California Department of Education CDE reported the breach on Friday, revealing that an unauthorized person accessed student records maintained by Educational Testing Service, a nonprofit that conducts statewide assessments.
The compromised data may include students’ names, birth dates, home addresses, demographic information, disability details, and testing records.
California officials indicated that the breach affects records of students enrolled over the past three school years.
In the 2025 – 26 academic year alone, over 5.7 million students were enrolled in California public schools, though the exact number of those impacted is still unknown.
Hacker Used Compromised Login Credentials
The CDE stated that ETS noticed suspicious activity on September 25, 2026, involving a secure file transfer system.
An investigation with cybersecurity experts found that an unauthorized user accessed the system and copied files containing student information from May 22 to September 18 using compromised login credentials.
The affected ETS system was used to share statewide assessment data with the education department, indicating that the breach occurred within the contractor’s system, not the department’s network.
Upon discovering the intrusion, ETS disabled the compromised account and took the file transfer site offline. The company created a new system with enhanced security measures and continues to review additional protections.
What Student Information Was Exposed?
The exposed information varies for each student. According to the California Department of Education, it may include:
- Names, birth dates, home addresses, schools, districts, and grade levels.
- Statewide and local student identification numbers.
- Demographic details, such as race or ethnicity, primary language, and English learner status.
- Disability status, testing accommodations, and related educational information.
- Information on participation or eligibility for specific educational support programs.
- Records of English language proficiency and statewide assessment participation and results.
The department confirmed that Social Security numbers, financial account details, passwords, and personal information of parents or guardians were not involved.
ETS reported no evidence that the copied information has been made public, but the absence of public disclosure does not guarantee the data won’t be misused.
This incident underscores the sensitivity of student information, which can remain confidential long after a student leaves school. Data like addresses, identification numbers, and disability details can be particularly vulnerable.
Families Begin Receiving Data Breach Notifications
ETS started notifying affected students and families on October 16, coordinating with the California Department of Education and the State Board of Education.
The notification process is expected to continue through early November as they identify those impacted and provide information about the breach.
Officials noted that both current and former students whose records were managed by the contractor may be affected.
ETS is providing two years of identity protection services through Experian Identity Works at no cost to impacted students. The official notification details the information involved and how eligible individuals can enroll in the service.
Families who believe they may be affected should check notices from the California Department of Education or ETS and visit the official state incident information page for available assistance.
Testing Contractor Strengthens Security Measures
ETS has taken steps to enhance its system security, including taking the affected site offline, developing a new file transfer system, improving access controls, and increasing monitoring.
The company is also reviewing its security practices further. Law enforcement and cybersecurity experts are involved in investigating the incident.
The breach was reported as the company and state authorities worked to assess the exposure and support affected families.
The California Department of Education is collaborating with state cybersecurity partners to evaluate the impact and ensure that individuals whose records were accessed receive the necessary information and support.
Incident Raises Questions About Education Data Security
This breach highlights the risks associated with the large amounts of sensitive information held by companies serving public education systems.
Testing contractors need student data to conduct assessments and manage related programs, but this incident shows how compromised credentials can lead to unauthorized access to sensitive records when security measures fail.
For schools and government agencies, this incident emphasizes the need to limit access to student information, strengthen authentication processes, monitor systems for suspicious activity, and ensure contractors maintain robust cybersecurity measures.
For affected families, the immediate focus should be to understand the information involved and how to access the offered identity protection services.
The investigation is ongoing, with state officials and ETS affirming they have found no evidence of the copied information being made public. However, authorities continue to assess the breach and mitigate the risk of further exposure.