Hacker Copied Records of Millions of California Students From ETS

What happened in the California student data breach

A single stolen login gave an intruder months of access to files that carry California student test data between the state and its testing vendor. The California Department of Education posted a notice on October 16 saying Educational Testing Service, or ETS, had found unauthorized copying of student data from an ETS secure file transfer site.

ETS is a New Jersey-based nonprofit that administers the state’s standardized testing under a state contract, including the CAASPP and ELPAC assessments, according to GovTech. The file transfer site is the channel ETS and the state use to exchange that assessment data, SecurityWeek reported.

The investigation found that someone used a compromised login at various times from May 22 to September 18, 2026, to copy files containing California student information. ETS spotted the activity on September 25, disabled the account, took the site offline and brought in outside cybersecurity experts. Law enforcement and the California Cybersecurity Integration Center are assisting.

State officials are still working out the scope. In a letter cited by Education Week, Deputy Superintendent Mary Nicely said state education officials are “urgently working with a team of state agencies” to determine the scope and impact of the incident.

Which students and families may be affected

California’s public schools enrolled more than 5.7 million students in 2025-26. Reporting that counts recent former students puts the total closer to 7 million, but no official figure has been published.

The copied files cover students enrolled over the past three school years, along with some former students whose records date to 2006. That reach matters for families who have since moved out of state. A child who left a California district years ago may still be in the files, and a parent may not hear about it if the notice goes to an outdated address.

What data was exposed, and what was not

Reporting indicates the exposed fields include names, birth dates, home addresses, demographic details, student ID numbers, assessment results and disability status. Cybernews and Technology.org both describe those fields, though the sources reviewed do not publish the full file layout.

ETS and state officials say Social Security numbers, financial account information, passwords and parent or guardian data were not involved, according to coverage from SOFX and Technology.org. The state also says the copied data has not been found published publicly, according to LAist.

The absence of Social Security numbers does not make the data harmless. A name, a birth date and a home address are enough to make a phishing message look like it came from a school or testing office. Disability status adds another layer, since a scammer who knows a child’s accommodations can sound like a special education office. Those are the details that make school-impersonation scams convincing, and they are hard to change once they leak.

How one stolen login stayed hidden for four months

A secondary explainer from Shattered.io describes the incident as credential theft rather than a software exploit, and says no novel exploit or zero-day was used. That point has not been checked against the state’s notice, so treat it as unconfirmed.

Several basic facts remain open. The sources reviewed do not say whether the credential belonged to a person or to a shared or service account, or how long it stayed valid. They also do not name the intruder or say whether the stolen files have been sold.

Four months of copying raises a hard question for any vendor that holds student records. A file transfer site carrying millions of records should flag unusual download volume, and the sources do not say what alerts ETS had in place or why the activity was not caught sooner. Districts and vendors will likely ask about multifactor authentication and regular access reviews, but no source confirms which controls were missing.

California has handled a similar case before. The state attorney general settled with Illuminate Education over a student-data breach, with $3.25 million in civil penalties and security commitments, after more than 434,000 California students had sensitive information stolen, according to the attorney general’s statement. That statement also stressed heightened duties for companies handling children’s data and treated disability status as especially sensitive.

What ETS and the state are doing now

ETS built a replacement SFTP site with added access controls and more monitoring. It is also offering two years of identity protection, which works out to 24 months, according to the state notice and coverage of it.

The response has three immediate effects. Districts that rely on ETS and the state exchange site will face parent questions and may need to review vendor contracts. Other states that use ETS for assessments may face their own scrutiny of vendor access controls. Whether other ETS clients were affected has not been reported.

The scale also puts this breach in context with other recent data losses. The iRhythm breach that could reach 8.2 million Zio heart monitor patients is a health-data case, while this one involves minors and school records that many families never think of as sensitive. Both show how much personal information sits with third-party vendors that families never chose.

What parents should do this week

The following steps are general guidance and do not come from the state notice. They are worth taking now, whether or not your child has received a letter.

1. Check the California Department of Education incident page for the official notice instead of relying on forwarded messages or social posts.
2. If you receive a notice, enroll in the free ETS identity protection, which runs for two years.
3. Consider a credit freeze for your child. Minors’ credit files are often unused, so a freeze can block new accounts opened in a child’s name. Contact each of the three national credit bureaus to request one.
4. Be wary of calls, texts or emails that mention state testing, ETS or CAASPP and ask for personal details or payment. Verify by calling the school at a number you already have.
5. Ask your school whether the district has been told about the vendor incident and what it is doing about it.

What to watch next

The next signal will be an official count. Once the state publishes one, families, districts and regulators will know whether the figure is closer to 5.7 million or to 7 million, and how many former students must be reached at addresses that may be years old.

Watch whether the state or federal government opens a formal enforcement action, as California did with Illuminate. Enforcement takes months, and payouts can take longer. USA 24 has followed one such payout in the Conduent data breach settlement, which set up an $80 million fund for 62 million people.

Also watch for signs that the stolen files have surfaced on criminal marketplaces or leak sites. Nothing in the sources reviewed shows that yet, but a credential-driven breach of this size often ends with the data being sold or traded. For families, the practical question is whether the scams that follow arrive in the name of a school, and that is where the next wave of reporting is likely to focus.