Millions of California students' data exposed after hackers lurk in third-party testing system for months
A compromised login gave a hacker months-long access to sensitive California student data.
Image by renanfacciolo | Shutterstock
Follow us
- Millions of California students had sensitive personal and educational data exposed.
- Attackers accessed ETS file-transfer systems from May through September, with some records dating back to 2006.
- Exposed data includes names, addresses, birth dates, student IDs, demographics, assessment data, and disability information.
- ETS says Social Security numbers, financial data, passwords, and parent or guardian information were not accessed.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The personal data of millions of California students is compromised after hackers breach the New Jersey-based Educational Testing Service (ETS), a nonprofit contractor that administers statewide assessments.
The California Department of Education (CDE) publicly announced the massive breach on Friday, revealing that the attackers spent nearly five months lurking inside ETS systems.
As of now, the CDE is confirming that hackers gained access to the records of all students enrolled in California public schools over the past three years, as well as some former students dating back to 2006.
The investigation determined that an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026,the California Department of Education (CDE) said in the breach notice.
Hackers lurked for months
ETS – the Princeton-based non-profit contracted by California to administer state and federally required testing – said it discovered the unauthorized activity on September 25.
Investigators say the attackers used a compromised login credential to access an ETS secure file transfer protocol (SFTP) site – a protocol that enables secure communication between ETS and the CDE to transfer statewide assessment information.
Following discovery of the incident, ETS has taken numerous measures to enhance the security of the SFTP site, including taking the SFTP site offline and building an entirely new SFTP site with enhanced security controls,the Educational Testing Service (ETS) said in a statement released by the California Department of Education on October 16, 2026.
The non-profit said it began notifying affected students and families on Friday, October 16, with notifications expected to continue through early November.
To put the breach in perspective the number of student senrolled during the 2025-2926 school year was more than 5.7 million, across over 1000 districts.
What data was involved?
According to the CDE, the compromised student data includes:
- Names, birth dates, residential address
- Grade level, schools, districts, statewide and local student ID numbers
- Demographic information – gender, race or ethnicity, country of origin
- Statewide assessment data, primary language, English learner status, English language proficiency information
- Disability status, testing accommodations, primary disability type
- Section 504 status, eligibility for certain federal programs
ETS says the hackers did not access Social Security numbers, driver's license and passport numbers, financial account information, credit and debit card information, passwords, and parent or guardian information.
As of Friday, ETS says there is no evidence the stolen data has been made public.
The CDE is offering affected current and former students two years of free identity-protection services through Experian IdentityWorks, the notification shows.
State testing disrupted
ETS administers California's statewide assessment programs, including the California Assessment of Student Performance and Progress and English Language Proficiency Assessments for California.
On October 2nd, ETS sent a letter to county and district school officials, stating that the company had stopped processing "normal enrollment data processing."
"We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices,"ETS said in a statement sent to Reuters.
"Our priority remains the students, families, and educators we serve and safeguarding the assessment programs we deliver for our clients and partners globally," the company said.
ETS said it is now actively working to minimize disruption to assessment activities and restore services in a timely manner.
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
