Hackers Copied California Student Data From a State Testing Contractor’s Server

A hacker used a stolen or compromised login to copy files containing data on California public-school students from a server run by testing contractor Educational Testing Service (ETS), the state’s Department of Education says. The data includes names, dates of birth, addresses and disability information. The department has not given a total, but the Los Angeles Times reports that millions of current and former students are affected.

What happened

ETS, a nonprofit that runs California’s statewide assessments under contract with the state, identified “unauthorized activity” on 25 September 2026 on a secure file transfer protocol (SFTP) site used to exchange assessment data with the California Department of Education (CDE), according to the department’s incident FAQ.

ETS disabled the account involved, took the site offline and brought in outside cybersecurity experts. “The investigation determined that an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026,” the CDE says. In other words, the access ran for almost four months before it was spotted.

In a news release on 16 October, the department said ETS has built “an entirely new SFTP site with enhanced security controls”. It also said ETS has worked with law enforcement and cybersecurity experts to reduce the risk of the data being published. “ETS, following regular web monitoring, has, to date, not uncovered any evidence that the information has been made public,” the CDE says.

What data was taken

The CDE says the information “varies by individual” and not every record contains every field. It may include:

• Names, dates of birth, home addresses, schools, districts and grade levels.
• The Statewide Student Identifier (SSID) and local student ID numbers.
• Demographic details, including gender, race or ethnicity, primary language, country of origin and English learner status.
• “Disability and Section 504 status”, testing accommodations and primary disability type.
• Eligibility for programmes including Title I, McKinney-Vento (for homeless students) and Military Connected Student status.
• English proficiency information and statewide test registration, participation and results.

The department says the copied data did not include Social Security numbers, driver’s licence or passport numbers, financial account or card details, or passwords. It also did not include any information about parents or guardians.

Who is affected

The CDE says affected people include current and former students enrolled in California public schools “between 2023 and the current school year”. It also covers students who left a California school since 2006 and did not confirm a transfer to another school with the department.

The department does not give a total. The Los Angeles Times reports that the breach affects “many more than the state’s current 5.7 million public-school students”, because it reaches back to 2023 enrolments and includes some earlier leavers.

Notifications began on 16 October and are expected to continue through early November. The CDE warns that not receiving a letter “does not necessarily mean” a student was unaffected, particularly if contact details have changed.

What families can do

ETS is offering affected current and former students 24 months of free Experian IdentityWorks identity protection, with an enrolment deadline of 19 March 2027. Parents enrol children under 18, and former students who are now adults can enrol themselves.

The department advises families to be wary of unexpected emails, texts or calls that mention a student’s school, state tests or the incident, and to check web addresses before entering any details to enrol. Adults can freeze their credit files for free, and parents can request credit freezes for children under 16.

What we don’t know

• The total number of students affected.
• Who was behind the attack, and whether any ransom was demanded.
• How the login credential was compromised.

What this means

• A compromised login gave an attacker access to ETS’s California file-transfer site from 22 May to 18 September 2026, and student files were copied.
• The data includes sensitive details such as disability status and programme eligibility, but not Social Security numbers, financial data, passwords or parent information.
• Notices are going out until early November. Affected students can get two years of free identity protection.

Sources

• California Department of Education: ETS begins notifying California students and families following data security incident
• California Department of Education: ETS incident FAQ
• Los Angeles Times: Standardized testing hack exposes names and addresses of millions of students

Related stories

• Cyber Breaches, 9 October 2026: A Biotech’s Old Cloud, a Turkish University and a Louisiana Clinic
• Cyber breaches this week: credential reuse, retail alerts, campus ransomware and edge-gear risk
• Nikkei Says 1.83 Million Personal Data Items Leaked From a Development Cloud