# California Student Data Breach at ETS Exposes Millions of Records

- URL: https://usa-24.com/ets-data-breach-california-students/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-17T05:37:45.038Z
- Updated: 2026-10-17T05:37:45.046Z
- Topics: Data Breach, Student Privacy, Education Technology, California, Cybersecurity

> A hacker used a compromised login to copy California student files from a file-transfer site run for testing contractor ETS. Notices began going out Friday.

## Key takeaways

- A compromised login let an unauthorized party copy California student files from an ETS file-transfer site between May 22 and Sept. 18, 2026.
- Exposed fields reported across sources include names, addresses, birth dates, demographic information, student IDs and disability status.
- The state and ETS say Social Security numbers, financial information, passwords and parent or guardian information were not involved.
- Reports disagree on scale, with one citing about 7 million students across three school years and another citing more than 5.7 million enrolled in 2025-2026.
- ETS identified the unauthorized activity on Sept. 25, and families began receiving notification letters on Friday, Oct. 16.

A hacker copied millions of California students' names, birth dates, addresses and disability records from a file-transfer site run for the state's testing contractor. The California Department of Education (CDE) and Educational Testing Service (ETS) disclosed the ETS data breach on Friday, Oct. 16, 2026, the same day ETS began sending notification letters to families.

The intruder never reached the state's own network. The entry point was a third-party vendor system, a pattern that recurs across education and government data incidents. The access ran through a secure file transfer protocol (SFTP) site that ETS uses to exchange California statewide assessment information with the state.

## What happened in the ETS data breach

ETS found unauthorized activity on that site on Sept. 25, 2026, according to the [CDE incident page](https://www.cde.ca.gov/nr/in/ets-incident.asp). The state says an unauthorized party used a compromised login credential to copy student files at various times between May 22 and Sept. 18, 2026.

ETS disabled the account, took the SFTP site offline and brought in outside cybersecurity experts. It has since built a new SFTP site with added security controls, [Just the News reported](https://justthenews.com/politics-policy/education/hack-exposes-personal-information-millions-california-public-school). Law enforcement has been notified and is investigating.

The timing of the notices matters. The state sent a letter to school districts dated Oct. 2 saying ETS had paused processing of enrollment data and certain testing activities while its systems are assessed. The first public notice followed two weeks later, on Oct. 16, so families are hearing about the incident roughly three weeks after ETS identified it.

## Which students and families may be affected

ETS is a New Jersey-based nonprofit that administers California's statewide assessments, including the CAASPP and ELPAC tests. That role puts its systems in front of a large share of the state's public school students.

The state says the affected information covers all students enrolled in the three previous school years, and some records reportedly go back further. Cybernews reported that some records date to 2006, while another outlet tied the breach to 2023 enrollments. The earliest year remains unresolved, so parents should not assume a child falls outside the window based on the dates in any single report.

The headcount is also unsettled. One report puts the figure at about 7 million students across three school years. Another says more than 5.7 million students were enrolled in California in 2025-2026. These numbers measure different things. The first is a multi-year count, and the second is one year's enrollment, so they should not be merged into a single total. The sources reviewed do not include a final official count.

Current and former California public school students and their families are in scope, along with districts that rely on ETS for state testing. Adults who were students in recent years, and possibly earlier, may be included. Districts face their own workload, since they field parent questions and manage the paused enrollment processing.

## What data was exposed, and what was not

According to the state and ETS, the exposed fields include names, addresses, birth dates, demographic information, student IDs and disability status. Disability status is among the most sensitive records a school system holds, and it is part of what makes this incident more serious than a routine contact-list leak.

The state and ETS say several categories were not involved: Social Security numbers, financial information, passwords and parent or guardian information. That distinction matters. Without Social Security numbers, the most direct route to opening new credit is harder to exploit. Names and birth dates, however, are permanent identifiers. One outlet argues they remain useful to fraudsters for years. That is an analysis from a single source, not an official finding, but it explains why families should act on the notice even without financial data.

ETS said it has not found evidence that the data has been made public, based on regular web monitoring. The sources reviewed do not identify a criminal group that has claimed the files.

## How long the intruder had access

Cybernews describes the intrusion as lasting "nearly five months," which roughly matches the May 22 to Sept. 18 window. The timeline below shows how the incident moved from copying files to public notice.

| Date | What happened |
|---|---|
| May 22, 2026 | Earliest date in the state's compromise window |
| Sept. 18, 2026 | Latest date in the state's compromise window |
| Sept. 25, 2026 | ETS identifies unauthorized activity on the SFTP site |
| Oct. 2, 2026 | State letter to districts reports paused enrollment-data processing and certain testing |
| Oct. 16, 2026 | State posts first public notice; ETS begins notifying families |

The public record does not say whether the credential was taken through phishing, a reused password or a flaw on the vendor side. Those questions will matter for any state or district that relies on outside contractors.

## What parents and schools should do now

Start with the official documents. The [ETS notification page](https://www.cde.ca.gov/nr/in/ets-notification.asp) and the CDE incident page carry the letter and the identity-protection enrollment deadline, so check them before you take any step that depends on a date.

- Confirm the notice first. Compare any message about the breach with the CDE incident page and the ETS notification.
- Be wary of unexpected emails, calls or texts that claim to come from ETS, the state or a credit-monitoring company. Confirm through official channels before clicking links or sharing personal details.
- Consider a free credit freeze with Equifax, Experian and TransUnion. Freezes are especially worth considering for children, whose identities can be misused for years before a family notices.
- Watch for any credit card, loan or collections notice addressed to a child.
- Hold off on a password reset unless the notice calls for one. One outlet reports that no passwords or login credentials were exposed, so a reset is not believed to be required. Confirm that against the official notice before acting.

Parents with children in a district that uses ETS should also ask the district how it is handling paused enrollment processing and testing, and what it has been told about the notice.

## What comes next for ETS and California

The state is reviewing ETS's compliance with its data-security obligations. A California Department of Education spokesperson, who was not named in the syndicated report from [Yahoo News](https://www.yahoo.com/news/us/articles/hack-exposes-data-millions-california-205836862.html), said: "We are taking this incident extremely seriously, working with state cybersecurity experts, and reviewing ETS's compliance with its data security obligations."

ETS has said it "continues to evaluate additional security measures that may be appropriate," according to the state's [press release on the incident](https://www.cde.ca.gov/nr/ne/yr26/yr26rel45.asp).

Several questions remain open. The state has not said whether it will seek penalties, change ETS's contract or look for a new vendor. ETS has not said when enrollment-data processing and certain testing will fully resume. It is also unknown whether other states' testing systems used the same SFTP site or vendor.

USA 24 has covered other breaches that put large numbers of Americans' data at risk, including a [Central Ohio Primary Care breach](https://usa-24.com/central-ohio-primary-care-data-breach/) that exposed data on 1.4 million people and an [iRhythm breach](https://usa-24.com/irhythm-data-breach-zio-monitor-patients/) that may reach 8.2 million heart monitor patients. Each shows how a single organization's weak point can expose a large population. The ETS case adds a particular twist: the records belong to children, and the families who must act on them may not learn of the problem until months after the copying began.

Watch three things next. The first is a final count and the earliest year covered, which will tell families whether the notice applies to them. The second is the state's compliance review and whether it leads to penalties or a new contract. The third is when ETS resumes enrollment processing and testing, which will show how quickly its new SFTP site and added controls return to normal operations.

## Frequently asked questions

### Is my child affected by the ETS data breach?

The state says the affected information covers all students enrolled in the three previous school years, and some records may go back further. Families are receiving ETS notification letters starting Friday, Oct. 16, and the state has said notifications will continue. Check the official notice on the CDE incident page or in the letter itself, rather than relying on news reports of the total.

### Did the ETS breach expose Social Security numbers?

The state and ETS say Social Security numbers, financial information, passwords and parent or guardian information were not involved. The reported exposed fields include names, addresses, birth dates, demographic information, student IDs and disability status. Names and birth dates are permanent identifiers, so families should still watch for suspicious activity.

### How many California students were affected?

Reports conflict. One outlet says about 7 million students across three school years, while another says more than 5.7 million students were enrolled in California in 2025-2026. Those figures measure different things, and the sources reviewed do not include a final official count.

### What is ETS and why does it have student data?

ETS is a New Jersey-based nonprofit that administers California's statewide assessments, including the CAASPP and ELPAC tests. It exchanged statewide assessment information with the state through a secure file transfer protocol site, which is where the unauthorized access occurred. The state is now reviewing ETS's compliance with its data security obligations.

### Should I reset my child's password after the ETS breach?

One outlet reports that no passwords or login credentials were exposed, so a password reset is not believed to be required. Confirm that against the official ETS or CDE notice before taking action. A free credit freeze is a separate step that many families consider for children.

## Sources

1. [California student data breach exposes millions of records — Cybernews](https://cybernews.com/news/california-student-data-breach-millions-records-ets-hack/)
2. [Educational Testing Service (ETS) Incident — California Department of Education](https://www.cde.ca.gov/nr/in/ets-incident.asp)
3. [Educational Testing Service (ETS) Notification — California Department of Education](https://www.cde.ca.gov/nr/in/ets-notification.asp)
4. [ETS Begins Notifying California Students and Families Following Data Security Incident — California Department of Education](https://www.cde.ca.gov/nr/ne/yr26/yr26rel45.asp)
5. [Hack exposes data on millions of California students — Yahoo News](https://www.yahoo.com/news/us/articles/hack-exposes-data-millions-california-205836862.html)
6. [Hacker accessed data on millions of California students, state says — Mezha](https://mezha.net/eng/news/mezha-290bdf255666f2d67de7bd97_hacker_accessed_data)
7. [Hack exposes personal information on millions of California public school students — Just the News](https://justthenews.com/politics-policy/education/hack-exposes-personal-information-millions-california-public-school)
8. [Standardized testing hack exposes names and addresses of millions of students — News Beep](https://www.newsbeep.com/773722/)
9. [California Department of Education Student Data Breach via ETS — GalaxyWarden](https://www.galaxywarden.com/blog/breach/california-department-of-education-ets-breach-2026-10)