Millions of current and former California public school students have had their personal data compromised following a cyberattack on Educational Testing Service, a nonprofit organization that handles standardized testing for the state. State education officials announced Friday that the stolen information includes names, home addresses, disability records, and academic demographic data.
The breach affects significantly more individuals than the state’s current enrollment of 5.7 million public-school students. Because the compromised database tracks records dating back to 2006, affected individuals include former students who left the system without confirming a school transfer, as well as anyone who took mandated state assessments in subsequent years.
According to the California Department of Education, ETS discovered the unauthorized access on September 25. An internal investigation revealed that an unauthorized party used a compromised login credential to access the network and copy files containing student information at various times between May 22 and September 18, 2026.
State Deputy Superintendent Mary Nicely stated in a letter that education officials are urgently collaborating with state agencies to investigate the scope of the incident. While public notification was issued on Friday, local school district leaders were informed earlier on October 2.
ETS maintains extensive demographic, test participation, and assessment data to support required evaluations such as the Smarter Balanced tests administered each spring. Exposed fields in the breach include student grade levels, dates of birth, attended schools and districts, unique student identifier numbers, gender, race, ethnicity, primary language, country of origin, and English learner status.
The unauthorized party also accessed sensitive records concerning student disabilities and eligibility for federal low-income support programs. However, officials confirmed that the stolen files did not include Social Security numbers, driver’s licenses, passport numbers, financial accounts, credit or debit card data, passwords, or the personal information of parents and guardians.
State officials noted they have not yet found evidence that the stolen data has been publicly released, though they acknowledged that hackers frequently hold confidential information pending ransom demands. The official release did not disclose whether a ransom demand had been made in this case.
Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute, raised concerns over how a single compromised username and password could facilitate such a widespread breach. He emphasized that outsourcing data storage does not absolve school systems of the resulting consequences, warning that centralizing millions of student records with a single vendor creates statewide vulnerabilities.
ETS spokesperson Christine Betaneli defended the organization’s security measures, stating that they maintain a comprehensive information security program regularly evaluated by third parties. Betaneli added that no other ETS customers were affected and that the organization has implemented enhanced monitoring, strengthened access controls, and additional third-party security reviews.
Affected former students, including adults, are eligible for 24 months of free identity-protection services and identity-restoration assistance. Officials advised parents of children under 16 to consider requesting free credit freezes and warned the public to remain cautious of unsolicited communications falsely claiming to represent state agencies or credit monitoring companies.
