Hackers had access for about four months to a file-transfer site run by Educational Testing Service, and the California student data breach that followed may touch roughly 7 million students. The state has not published an official victim count, so that figure comes from plaintiffs’ lawyers and a secondary news outlet. The files reportedly include names, birth dates, home addresses, disability records and state test results, which makes this more than a routine vendor incident.
ETS is the nonprofit that runs California’s CAASPP and ELPAC testing for the state. The California Department of Education alerted school districts on Oct. 2, 2026, and disclosed the incident publicly on Oct. 16. ETS began notifying families later that same month, and two proposed class actions followed within days.
The scale is the reason this story reaches beyond California. The data covers current students and former students, and the disability and program records raise the stakes of any follow-on scam. The central question is how a single login reached this much data.
How the California student data breach unfolded
The intruders used a compromised login to copy files from a secure file transfer (SFTP) site that ETS operated. According to the state’s notice, the access window ran from May 22 to Sept. 18, 2026. ETS spotted unauthorized activity on Sept. 25, disabled the account and took the site offline. It later built a new platform.
A file-transfer server is an attractive target because it holds bulk files in one place. One stolen credential can open many records at once, and that is the core of the criticism. GovTech reported that experts focused on the same point: a loss this large could follow from one credential, and the reporting did not mention multi-factor protection on that account.
The key dates so far:
- May 22, 2026: Access window opens
- Sept. 18, 2026: Access window ends
- Sept. 25, 2026: ETS detects unauthorized activity and disables the account
- Oct. 2, 2026: State alerts school districts
- Oct. 16, 2026: California Department of Education discloses the incident publicly
Several gaps remain. The notice does not explain how the login was compromised, and the state has not named the attackers or their motive. CyberInsider reported no ransom demand. ETS says it has found no evidence so far that the stolen data has been published, though monitoring continues, according to Malwarebytes.
Which data was exposed, and what was left out
Reporting on the state notice lists the exposed categories: student names, birth dates, home addresses, school and grade, statewide student IDs, demographic data, English learner status, disability and Section 504 information, program eligibility such as low-income or unhoused status, and state test results. LAist summarized the categories for families.
The state says Social Security numbers, driver’s license numbers, financial account data, passwords and parent or guardian information were not involved. That narrows the risk, but it does not remove it. Disability and program data goes well beyond a name and an email address. A message that mentions a child’s learning needs or eligibility for support programs can sound far more believable to a parent than a generic alert.
Coverage reaches well beyond current classrooms. The notice reportedly covers students enrolled from 2023 onward, plus students who left since 2006 without a confirmed transfer. California had more than 5.7 million students enrolled in public schools in 2025–26, so a roughly 7 million estimate fits a window that includes former students. No official count has been published, and that gap is the first thing to watch.
What families should do now
Start with the official notice. The steps below draw on the state notice and on outlets that reviewed it.
- Check for the official notice. Compare any letter, email or text about the breach with the California Department of Education and ETS notice before clicking links or sharing information.
- Enroll in the monitoring offer. The College Investor reported free Experian enrollment through March 19, 2027. One local notice, reported by Sierra News Online, described two years of free identity protection, so read the exact terms in your letter.
- Freeze your child’s credit where available. The College Investor reported that credit freezes for children under 16 are free, but confirm the process directly with each credit bureau.
- Watch for warning signs, including school enrollment or testing records that do not match and unexpected loan or credit notices in your child’s name.
- Be skeptical of unsolicited contact that mentions ETS, CAASPP or ELPAC. Verify with your school district first, since the notice warns of follow-on scams.
Treat legal outreach carefully. Lawyers commonly advertise free case reviews after incidents like this, and a solicitation does not confirm that your child’s record was taken. Check court filings directly. The Los Angeles complaint is listed as PL01 v. Educational Testing Service, No. 2:26-cv-12163, in the Central District of California.
Two class actions and the state’s contract review
Two proposed class actions have been filed against ETS. One is in federal court in Los Angeles, and the second is in federal court in Northern California. OpenClassActions lists the Los Angeles case, which alleges ETS did not notice the intrusion until about a week after the last access. That timing lines up with the state’s dates: access ended Sept. 18, and ETS flagged activity on Sept. 25.
Filing dates differ by outlet. One tracker gives Oct. 17 for Los Angeles and Oct. 20 for Northern California. Another report gives Oct. 20 for a suit and Oct. 22 for a law firm press release. Until court dockets confirm the dates, treat them as unsettled.
The plaintiffs have already made their case in public. In a Business Wire release, Joe Cotchett, founder of Cotchett, Pitre & McCarthy, said ETS “needed the sensitive and private information of California’s young people to run its testing business.” That is a plaintiffs’ lawyer’s claim, not a finding by investigators.
On the state side, education officials said they are reviewing whether ETS complied with its contract’s data security requirements, as GovTech reported. In a letter cited by reporters, state Deputy Superintendent of Public Instruction Mary Nicely said the state is “urgently working with a team of state agencies to investigate and determine scope and impact of the incident.” Whether ETS violated its contract remains an open question.
What this breach signals for school data vendors
This breach happened inside a contractor’s system, not inside a local school district’s network. The case summary from Emery Reddy draws that line. It matters because districts and the state hand sensitive student files to outside vendors, and the vendor’s security becomes part of the district’s exposure.
Similar incidents are piling up this year. USA 24 covered the Navigate360 breach, which exposed 8.3 million school tip records. The common thread is sensitive records held by vendors that families rarely see.
One analysis from Shattered.io speculated that California could tighten education-vendor security rules after this case. That is one analyst’s view, not a confirmed plan, and the state notice does not commit to new requirements.
Districts that rely on outside testing platforms should ask vendors direct questions now. Ask whether logins require multi-factor authentication, how quickly intrusions get reported, and how file-transfer sites are monitored.
The next answers will come from the state and the courts. Watch for an official victim count from the state, any explanation of how the login was taken, confirmation of whether the stolen files surface online, and the outcome of the contract review. For another records case now in court, see USA 24’s coverage of the Marines’ lawsuit over the Pentagon DMDC breach.
