Summary
- The affected files covered students enrolled during the three previous school years.
- The unauthorized access occurred between May 22 and September 18.
- Officials say Social Security numbers and sensitive financial information were not accessed.
Millions of student records were copied
A hacker accessed personal information belonging to California students by using a compromised login at Educational Testing Service, a nonprofit contractor that administers statewide assessments. The California Department of Education said the files covered all students enrolled during the three previous school years, placing millions of current and former students within the affected population. [1] [2]
The exposed information included names, birth dates, home addresses, demographic details and disability status. California enrolled more than 5.7 million students during the 2025-26 school year alone, though the state has not published a final unique-person total covering all three years. That makes any precise victim count preliminary. [1] [2]
A compromised credential opened the system
ETS said an unauthorized party used a compromised login to reach a secure file-transfer site and copy files at various times between May 22 and September 18. The contractor detected the incident on September 25 and began an investigation. The state disclosed the breach publicly in October as notifications were sent to affected families. [1] [2] [3]
The investigation has not found that the stolen information was posted publicly. Officials also said Social Security numbers and sensitive financial records were not among the accessed data. Those limits reduce some forms of immediate financial fraud, but identity and disability information can still be used for impersonation, phishing and targeted scams. [1] [2]
Families are being offered protection
California is distributing ETS's formal breach notice so students and families receive instructions about the incident and available assistance. The notice offers affected individuals 24 months of identity-protection services and identity-restoration support. Families should use the contact information in the official notice rather than links in unsolicited messages claiming to provide help. [2] [3]
The breach creates a particular risk of follow-on phishing because attackers may know a student's name, address and school-related details. A convincing message can imitate a district, testing provider or state agency. Parents should be cautious about unexpected requests for passwords, payments or additional identification documents. [2] [3]
Assessment operations and accountability
ETS temporarily stopped normal enrollment-data processing while it strengthened monitoring, access controls and third-party review. The California Department of Education said it was working to limit disruption and resume affected assessment activities. The incident shows how a contractor's account can become a route into statewide education data even when the state itself is not directly breached. [1] [2]
The unresolved questions include the exact number of unique people affected, why the compromised credential remained usable for months and whether additional safeguards would have detected the copying sooner. The state and ETS have not reported that the data was published, but monitoring and notification will remain necessary because stolen records can be held for later misuse. [1] [2] [3]
Reporting sources
This article follows our editorial standards. To report an error, see our corrections policy.