Massive Data Breach Exposes Personal Information of California Students

A significant data breach involving a state testing contractor has put millions of current and former California public school students at risk. This breach raises critical concerns about the access and storage of student information.

Details of the Breach

Hackers accessed sensitive records containing information such as home addresses, birth dates, and details about disabilities. The breach affects students who attended public schools in California, regardless of their current location. Some of the impacted records date back to 2006.

How the Breach Occurred

The breach involved the Educational Testing Service (ETS), which administers statewide assessments. Unauthorized access was gained through a secure file transfer site operated by ETS. Using compromised login credentials, the attacker copied files between May 22 and September 18, 2026. The suspicious activity was discovered on September 25, and immediate actions were taken to secure the site.

Impacted Information

Compromised files include:

• Student names and birth dates
• Home addresses, school names, and grade levels
• Identification numbers and disability information
• Assessment participation and test results

Fortunately, no Social Security numbers, financial details, or parent and guardian information were stolen.

Nationwide Impact

Though the breach originated in California, it could affect families across the U.S. if they or their children once attended a public school in California. The breach includes records from past and present students, potentially involving millions.

Ongoing Investigation and Security Measures

The California Department of Education is working with cybersecurity experts to investigate. ETS has strengthened its security controls and continues to monitor for any public exposure of data.

What Families Should Do

ETS has begun notifying affected individuals. However, concerned families should still take proactive steps:

1. Verify any notifications by visiting the California ETS incident webpage.
2. Consider enrolling in the free identity protection services offered.
3. Think about placing a security freeze on your child’s credit file.
4. Be vigilant of suspicious communications that could exploit compromised information.

Families can visit cde.ca.gov/nr/in/ets-incident.asp for more details.

Identity Protection Services

Affected individuals are eligible for two years of free identity protection. Enrollment is open until March 19, 2027. Relevant details are available on the California Department of Education’s website.

Protecting Your Child

Even without access to financial information, it’s crucial to safeguard your family’s data. Follow verified procedures on official sites and adopt a proactive approach to information protection.

Concluding Thoughts

This breach highlights the need for better data retention policies in educational systems. The question of how long schools and companies can hold onto student information deserves attention and clear guidelines.