LOS ANGELES, CA – Hackers stole personal information, including names, addresses and disability records, of millions of current and former California public school students from a state testing contractor, the California Department of Education announced Friday.
The department announced the breach Friday, Oct. 16, 2026. The data came from the Educational Testing Service, known as ETS, a nonprofit assessment organization that helps manage testing services for students in California public schools. That work includes the Smarter Balanced tests given each spring.
The breach reaches well beyond the state’s current 5.7 million public school students. It dates back to 2023 enrollments, and students who left California without confirming a transfer to another school were also affected, with records going back to 2006. According to initial reports, the exposed records cover roughly 7 million students enrolled over the past three school years.
Data taken from testing files
ETS maintains student demographic, test participation and assessment data for California. The exposed information includes each student’s name, address, date of birth, grade level, and the school and district the student attends.
The files also include unique student identifier numbers, gender, race or ethnicity, primary language, country of origin and English learner status. Student disability information and eligibility for federal programs, such as those that help students from low-income families, were also exposed.
Access ran from May to September
ETS identified unauthorized activity on its secure file transfer site on Sept. 25, according to the Department of Education’s notice. The company’s investigation found that an unauthorized party used a compromised login credential to access the site.
That party copied files containing California student information at various times between May 22 and Sept. 18, 2026. ETS took the affected site offline and disabled the account involved. According to initial reports, ETS also notified law enforcement and paused enrollment data processing and certain testing activities.
Districts were told Oct. 2
School district leaders received word of the breach on Oct. 2, two weeks before the public announcement. State Deputy Superintendent Mary Nicely addressed them in a letter.
Nicely wrote that state education officials “are urgently working with a team of state agencies to investigate and determine scope and impact of the incident, including what information may have been affected.”
What was not exposed
Officials said the stolen data did not include Social Security numbers, driver’s license numbers or passport numbers. It also did not include financial account information, credit or debit card information, or account passwords.
Parent and guardian personal information was not exposed, officials said.
Officials said they have not found evidence that the information has been made public. The department’s release did not say whether the hackers have made a ransom demand.
Identity protection and notices
ETS is offering affected current and former students two years of identity protection through Experian IdentityWorks at no cost to them. Notices to students and families began going out Oct. 16 and are expected to continue through early November.
ETS spokesperson Christine Betaneli said in a statement that the organization maintains a comprehensive information security program that is regularly assessed by third parties. She said ETS continuously invests in safeguarding its systems and data. She added that ETS has put additional safeguards in place, including enhanced monitoring and strengthened access controls.
State says contractors must meet high standards
The Department of Education said in a statement Friday that protecting student information is a top priority. The department said it expects its contractors to uphold the highest standards of data security and accountability.
The state is investigating with a team of state agencies. The law enforcement agency or agencies involved have not been named.
Cybersecurity expert questions safeguards
Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute, said one compromised login should not have allowed access on this scale. “A stolen login credential should not become a months-long passport to millions of students’ personal records,” he said.
Dahbura said that if a stolen credential is what happened, the critical question is why authentication safeguards, access restrictions and monitoring systems failed to detect and stop the unauthorized activity. He also said school systems may outsource the storage and processing of sensitive information but cannot outsource the consequences of a breach.
Earlier student data breach led to a settlement
California has dealt with a large student data breach before. In a release dated Nov. 6, 2025, the California Department of Justice announced a settlement with Illuminate Education over a 2021 breach.
Of the three million California students affected by that breach, more than 434,000 had sensitive information stolen, according to the release. California secured $3.25 million in civil penalties, and the three-state settlement totaled $5.1 million. In that case, the release said, a hacker used credentials from a former employee to get into Illuminate’s network.
Nothing in the information released so far connects the 2021 case to the ETS breach.
Notices continue through early November
The state’s investigation into the scope and impact of the breach remains active. Families of current and former students are expected to receive notices through early November.
