Hackers have stolen the data—including names, addresses, and disability records—of millions of current and former California public school students who took the state’s mandated standardized tests that annually assess their academic proficiency, education officials announced Friday.
The compromised information affects many more than the state’s current 5.7 million public-school students as the breach dates back to 2023 enrollments. Students who left California but did not confirm their transfer to another school also were affected, dating back to 2006.
The data breach involved Educational Testing Service, or ETS, which provides extensive services to California.
While the first public notice was Friday, school district leaders received word on Oct. 2.
State education officials “are urgently working with a team of state agencies to investigate and determine scope and impact of the incident, including what information may have been affected,” according to a letter from state Deputy Superintendent Mary Nicely.
ETS, a nonprofit assessment organization, helps manage and provide testing-related services for students enrolled in California public schools, including the required Smarter Balanced tests administered in spring. In this role, ETS maintains student demographic, test participation, and assessment data.
The exposed information also includes student grade level, date of birth, and the school and district students attend. The hackers also obtained access to unique student identifier numbers as well as information about gender, race or ethnicity, primary language, country of origin, and English learner status. Also exposed was information about student disabilities and student eligibility status for federal programs, such as those available to help students from low-income families.
The stolen data did not include Social Security numbers, driver’s license numbers, passport numbers, financial account information, credit or debit card information, or account passwords. Nor was parent or guardian personal information exposed, officials said.
ETS discovered the hack on Sept. 25. A subsequent investigation found that “an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026,” according to information posted by the California Department of Education.
Officials said they have not yet uncovered any evidence that the information has been made public. But it’s also true that hackers will often keep information confidential pending the outcome of a ransom demand.
The official release did not say whether such a demand has been made.
One cybersecurity expert expressed concern that such a vast breach could have occurred based on one compromised user name and password.
“A stolen login credential should not become a months-long passport to millions of students’ personal records,” said Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute. “If that is what happened here, the critical question is why authentication safeguards, access restrictions, and monitoring systems failed to detect and stop the unauthorized activity.”
He added: “Incidents like this expose a fundamental weakness in how we manage student data: School systems may outsource the storage and processing of sensitive information, but they cannot outsource the consequences of a breach. When millions of student records are concentrated with a single vendor, one security failure can become a statewide problem with consequences that follow children for years.”
A spokesperson for ETS defended the organization’s practices.
“ETS maintains a comprehensive information security program that is regularly assessed by third parties,” said Christine Betaneli. “We continuously invest in safeguarding the systems and data we maintain.”
Betaneli said no other “ETS customers” were affected.
“We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices,” Betaneli added.
Affected former students, including those who are now adults, are eligible for 24 months of free identity-protection services and identity-restoration help if there is identity theft.
Officials said that parents and guardians may want to consider requesting a free credit freeze for their children who are under 16 to help prevent unauthorized accounts from being opened in the names of their children.
“Be cautious of unexpected emails, phone calls, or text messages” related to the incident, including claims that the caller is from ETS or the state or a credit monitoring company, officials also warned.
“Do not provide Social Security numbers, passwords, financial information, or other sensitive personal information in response to unsolicited requests.”
Additional information and updates can be found at the CDE Educational Testing Service Incident webpage.
In May, a massive cyberattack sparked chaos across California colleges after hackers breached the company behind Canvas, one of the nation’s most widely used education technology platforms, where reading assignments are posted, tests are taken, and students chat with teachers.
The breach caused the company, Instructure, to temporarily take Canvas offline and interrupted classes, assignments, and finals preparations for hundreds of thousands of students and professors as hackers threatened to release their personal data.
A hacking group named ShinyHunters claimed responsibility for the attack. Instructure eventually announced it reached a deal with “the unauthorized actor involved” to return the compromised data, but didn’t say who that actor was or whether payment was involved. It said it obtained proof that copies of the data were destroyed, but acknowledged there was no way to know for sure.
The most widely noted hack of a local school district was the cyberattack on Los Angeles Unified over Labor Day weekend in 2022.
District officials took the unprecedented step of shutting down all district computer systems to limit the damage. School opened on schedule on Tuesday, but students, families, and staff had to reset more than 600,000 passwords. Many said a full week of instruction was lost, and technicians found “digital tripwires” left behind to further infect systems. The worst damage was in the facilities division, where about half the servers were encrypted—meaning that district staff could not access their own systems and records.
The district confirmed a ransom demand but refused to pay.
The district at first played down the harm from compromised information. Superintendent Alberto Carvalho said there was “no evidence of widespread impact” and called those affected “outliers.”
But a Los Angeles Times review of the leaked files found a 2005 student psychological assessment, despite district denials that such records had leaked. It also found employee discipline records, a worker’s criminal-history report, contractor payroll data, tax forms, and passports. And a later district filing to the state acknowledged that more than 500 people who worked for district contractors likely had Social Security numbers and other confidential information exposed. The district also later reported that about 2,000 student assessment records had been posted, including those of 60 current students.
