Millions of California Students’ Data Exposed in Breach

Empty classroom with police tape across desks — Photo: New Africa / Shutterstock

California’s education contractor says a single stolen login let an intruder copy student files from a secure site over four months, affecting data tied to multiple school years.

Story Highlights

Educational Testing Service (ETS) reported unauthorized access and copying of California student data from a secure file-transfer site.
Investigators traced use of a compromised credential between May 22 and September 18, 2026; ETS detected activity on September 25 and shut access.
Records may include names, student identifiers, birth dates, addresses, demographics, disability and program details, and state test data; Social Security numbers and financial data were not involved, according to officials.
Rough estimates suggest data linked to about seven million students over three school years was exposed, based on secondary reporting.

What Officials Say Was Accessed and When

California’s Department of Education says ETS, a statewide testing contractor, found signs of unauthorized activity on September 25, 2026. Investigators determined a compromised login was used multiple times from May 22 through September 18 to reach a secure file-transfer site and copy student files. ETS disabled the account and took the site offline, then brought in outside cybersecurity experts to investigate and support notifications to families. The agency framed the event as unauthorized access and copying of student information.

Officials say the data may include student names, Statewide Student Identifiers, dates of birth, mailing addresses, demographic details, disability information, program participation, and statewide assessment information. They say the breach did not involve Social Security numbers, financial account details, passwords, or parent and guardian information. The state directed ETS to notify students and families. ETS began outreach following the incident, according to the California Department of Education’s public notice.

How Many Students Could Be Affected

California’s notice states the files covered students enrolled during the prior three school years. The state did not publish a confirmed record count. Politico reported that data linked to about seven million students was exposed, reflecting the scale of enrollment over that period. The state’s phrasing leaves room for overlap across files and years, so the exact number of uniquely affected students remains unconfirmed in public materials. The core fact is that files were accessed and copied.

Public documents do not name the account owner or explain how the credential was stolen. The notices also do not identify the intruder or say whether the copied data was later posted, sold, or used for extortion. Officials say external cybersecurity experts assisted, but they have not released a technical report listing each accessed file or the forensics used to scope the event. Agencies often restrict details during active inquiries, which can delay deeper disclosures.

Why This Vendor Breach Matters Beyond California

School systems now rely on large vendors to handle tests and data. When a contractor’s account is compromised, many districts can be exposed at once. A national review found that about half of United States school districts reported a cybersecurity incident in 2025, with vendor-related events rising sharply as more work moved to common platforms. This California incident shows how one weak credential can open years of records across the state’s public schools.

California officials have announced a student data breach involving a statewide testing contractor. Affected families are being notified and offered free identity-protection services.https://t.co/HwCOYVxBal

— OCDE (@OCDeptofEd) October 20, 2026

Parents on both the left and right worry when institutions lose control of children’s data. Names, addresses, and disability or program details can follow a child for years. ETS and the state say the most sensitive financial identifiers were not involved, which helps reduce identity-theft risk. Still, copied personal and assessment data can be used for scams and targeted fraud. Families should watch mail for notices, use credit freezes for teens where allowed, and be alert to phishing.

What Accountability Could Look Like

Clear next steps could rebuild trust without partisan spin. The state and ETS could publish a redacted file inventory, listing each accessed file, date range, record counts, and fields. They could release an executive summary from the outside investigators, naming what controls failed and how monitoring missed the intrusions until September 25. Lawmakers could seek contract terms that require multi-factor login, faster detection, and faster notice to families after similar events.