A hacker copied millions of California students' names, birth dates, addresses and disability records from a file-transfer site run for the state's testing contractor. The California Department of Education (CDE) and Educational Testing Service (ETS) disclosed the ETS data breach on Friday, Oct. 16, 2026, the same day ETS began sending notification letters to families.
The intruder never reached the state's own network. The entry point was a third-party vendor system, a pattern that recurs across education and government data incidents. The access ran through a secure file transfer protocol (SFTP) site that ETS uses to exchange California statewide assessment information with the state.
What happened in the ETS data breach
ETS found unauthorized activity on that site on Sept. 25, 2026, according to the CDE incident page. The state says an unauthorized party used a compromised login credential to copy student files at various times between May 22 and Sept. 18, 2026.
ETS disabled the account, took the SFTP site offline and brought in outside cybersecurity experts. It has since built a new SFTP site with added security controls, Just the News reported. Law enforcement has been notified and is investigating.
The timing of the notices matters. The state sent a letter to school districts dated Oct. 2 saying ETS had paused processing of enrollment data and certain testing activities while its systems are assessed. The first public notice followed two weeks later, on Oct. 16, so families are hearing about the incident roughly three weeks after ETS identified it.
Which students and families may be affected
ETS is a New Jersey-based nonprofit that administers California's statewide assessments, including the CAASPP and ELPAC tests. That role puts its systems in front of a large share of the state's public school students.
The state says the affected information covers all students enrolled in the three previous school years, and some records reportedly go back further. Cybernews reported that some records date to 2006, while another outlet tied the breach to 2023 enrollments. The earliest year remains unresolved, so parents should not assume a child falls outside the window based on the dates in any single report.
The headcount is also unsettled. One report puts the figure at about 7 million students across three school years. Another says more than 5.7 million students were enrolled in California in 2025-2026. These numbers measure different things. The first is a multi-year count, and the second is one year's enrollment, so they should not be merged into a single total. The sources reviewed do not include a final official count.
Current and former California public school students and their families are in scope, along with districts that rely on ETS for state testing. Adults who were students in recent years, and possibly earlier, may be included. Districts face their own workload, since they field parent questions and manage the paused enrollment processing.
What data was exposed, and what was not
According to the state and ETS, the exposed fields include names, addresses, birth dates, demographic information, student IDs and disability status. Disability status is among the most sensitive records a school system holds, and it is part of what makes this incident more serious than a routine contact-list leak.
The state and ETS say several categories were not involved: Social Security numbers, financial information, passwords and parent or guardian information. That distinction matters. Without Social Security numbers, the most direct route to opening new credit is harder to exploit. Names and birth dates, however, are permanent identifiers. One outlet argues they remain useful to fraudsters for years. That is an analysis from a single source, not an official finding, but it explains why families should act on the notice even without financial data.
ETS said it has not found evidence that the data has been made public, based on regular web monitoring. The sources reviewed do not identify a criminal group that has claimed the files.
How long the intruder had access
Cybernews describes the intrusion as lasting "nearly five months," which roughly matches the May 22 to Sept. 18 window. The timeline below shows how the incident moved from copying files to public notice.
| Date | What happened |
|---|---|
| May 22, 2026 | Earliest date in the state's compromise window |
| Sept. 18, 2026 | Latest date in the state's compromise window |
| Sept. 25, 2026 | ETS identifies unauthorized activity on the SFTP site |
| Oct. 2, 2026 | State letter to districts reports paused enrollment-data processing and certain testing |
| Oct. 16, 2026 | State posts first public notice; ETS begins notifying families |
The public record does not say whether the credential was taken through phishing, a reused password or a flaw on the vendor side. Those questions will matter for any state or district that relies on outside contractors.
What parents and schools should do now
Start with the official documents. The ETS notification page and the CDE incident page carry the letter and the identity-protection enrollment deadline, so check them before you take any step that depends on a date.
- Confirm the notice first. Compare any message about the breach with the CDE incident page and the ETS notification.
- Be wary of unexpected emails, calls or texts that claim to come from ETS, the state or a credit-monitoring company. Confirm through official channels before clicking links or sharing personal details.
- Consider a free credit freeze with Equifax, Experian and TransUnion. Freezes are especially worth considering for children, whose identities can be misused for years before a family notices.
- Watch for any credit card, loan or collections notice addressed to a child.
- Hold off on a password reset unless the notice calls for one. One outlet reports that no passwords or login credentials were exposed, so a reset is not believed to be required. Confirm that against the official notice before acting.
Parents with children in a district that uses ETS should also ask the district how it is handling paused enrollment processing and testing, and what it has been told about the notice.
What comes next for ETS and California
The state is reviewing ETS's compliance with its data-security obligations. A California Department of Education spokesperson, who was not named in the syndicated report from Yahoo News, said: "We are taking this incident extremely seriously, working with state cybersecurity experts, and reviewing ETS's compliance with its data security obligations."
ETS has said it "continues to evaluate additional security measures that may be appropriate," according to the state's press release on the incident.
Several questions remain open. The state has not said whether it will seek penalties, change ETS's contract or look for a new vendor. ETS has not said when enrollment-data processing and certain testing will fully resume. It is also unknown whether other states' testing systems used the same SFTP site or vendor.
USA 24 has covered other breaches that put large numbers of Americans' data at risk, including a Central Ohio Primary Care breach that exposed data on 1.4 million people and an iRhythm breach that may reach 8.2 million heart monitor patients. Each shows how a single organization's weak point can expose a large population. The ETS case adds a particular twist: the records belong to children, and the families who must act on them may not learn of the problem until months after the copying began.
Watch three things next. The first is a final count and the earliest year covered, which will tell families whether the notice applies to them. The second is the state's compliance review and whether it leads to penalties or a new contract. The third is when ETS resumes enrollment processing and testing, which will show how quickly its new SFTP site and added controls return to normal operations.
