A data breach at a contractor for California’s public school system exposed personal records belonging to millions of current and former students, state officials have confirmed, including some whose files date back nearly two decades.
The breach originated with Educational Testing Service (ETS), a nonprofit that administers statewide assessments for the California Department of Education and stores records tied to those tests. State officials say an attacker used a compromised login credential to break into an ETS-operated secure file transfer site and copied student data at various points between May 22 and September 18, 2026.
ETS discovered the intrusion on September 25, disabled the compromised account, took the file transfer system offline, and hired outside cybersecurity investigators. The company has since built a replacement system with what it describes as stronger security controls. ETS says it has found no evidence so far that the stolen files have surfaced publicly, though investigators have confirmed the records were accessed and copied.
The exposed information includes home addresses, birth dates, and in some cases details about disabilities or whether a student qualified for programs serving children experiencing homelessness. Officials say the stolen files did not include Social Security numbers, financial account information, driver’s license numbers, passwords, or parent and guardian personal details.
Not just a California problem
Because the affected records span the previous three school years plus a group of former students who left California public schools as far back as 2006 without a confirmed transfer on file, the breach’s reach extends well beyond state lines. A family that moved from Los Angeles to Texas, or a graduate who now lives in Florida, could still be caught up in it. California has roughly 5.7 million public school students, and officials have not yet released a final count of how many unique individuals were affected.
ETS told reporters that no other ETS customers were affected by the incident, meaning the exposure is tied specifically to the company’s California Department of Education contract.
The California Cybersecurity Integration Center is assisting with the technical investigation, and state officials say they are reviewing whether ETS complied with its data security and contractual obligations.
ETS said in a statement: “We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices.”
What affected families can do
ETS began notifying affected students and families on October 16, 2026, with notifications expected to continue through early November. Not receiving a letter does not guarantee someone’s information was untouched — ETS may have outdated contact information for some former students.
Families can check the official California Department of Education incident page at cde.ca.gov/nr/in/ets-incident.asp, which includes breach notifications in 27 languages, or call the incident assistance line at 833-931-8488, Monday through Friday, 6 a.m. to 6 p.m. Pacific time.
ETS is offering affected current and former students 24 months of free identity theft protection, with enrollment open through March 19, 2027. Parents or guardians can enroll children under 18; adults, including former students, can enroll themselves. Identity restoration assistance is available for 24 months from the date of notification even for those who skip the monitoring enrollment.
State officials and privacy advocates note the breach raises a broader question that outlasts this particular incident: how long should schools and the private contractors they hire be permitted to retain sensitive records on children who may have left the system — or the state — years earlier, and who gets to decide when that data is finally deleted.
Add comment