Hackers stole data, including names, addresses and disability records, from millions of current and former California public school students who took the state’s mandatory standardized tests that assess their academic proficiency each year, education officials announced Friday.
Because the leak dates back to enrollment in 2023, the leaked information affects far more than the state’s current 5.7 million public school students. Since 2006, students who have left California without confirmed transfers to another school have also been affected.
The data breach involved Educational Testing Services (ETS), which provides a wide range of services to California.
Although the first public notification was on Friday, district leaders received the news on Oct. 2.
State education officials “are urgently working with state agency teams to investigate and determine the scope and impact of the incident, including what information may have been affected,” according to a letter from a state deputy sheriff. Mary is fine.
ETS is a nonprofit assessment organization that assists with administering and providing testing-related services to California public school students, including required Smarter Balanced testing in the spring. As part of this process, ETS maintains student demographic, test participation, and assessment data.
Exposed information also included the student’s grade, date of birth, and the school and district the student attended. The hackers also obtained unique student identifiers as well as information about gender, race or ethnicity, primary language, country of origin and English learner status. Information is also disclosed about student disabilities and a student’s eligibility status for federal programs, such as those available to help low-income students.
The stolen data did not include Social Security numbers, driver’s license numbers, passport numbers, financial account information, credit or debit card information or account passwords. No personal information of parents or guardians was leaked, officials said.
ETS discovered the hack on September 25. A subsequent investigation found that “an unauthorized party used compromised login credentials at various times between May 22 and September 18, 2026 to access the website and copy files containing California student information,” according to information released by the California Department of Education.
There is no evidence that the information has been made public
Officials said they had not found any evidence that the information had been made public. But it’s also true that hackers often keep information secret until the ransom demand is resolved.
Officials did not say whether such a request had been made.
One cybersecurity expert expressed concern that a breach of this magnitude could occur due to leaked usernames and passwords.
“Stolen login credentials should not be a passport to millions of students’ personal records for months,” said Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute. “If this is what happened here, the key question is why authentication protections, access restrictions, and monitoring systems failed to detect and block unauthorized activity.”
He added: “Incidents like this expose a fundamental weakness in how we manage student data: School systems may outsource the storage and processing of sensitive information, but they cannot outsource the consequences of a breach. When millions of student records are centralized with a single vendor, a security failure can become a statewide problem, with consequences that will follow children for years.”
A spokesman for ETS defended the organization’s practices.
“ETS maintains a comprehensive information security program that is regularly evaluated by third parties,” said Christine Betaneli. “We continually invest in protecting the systems and data we maintain.”
Bertanelli said no other “ETS customers” were affected.
“We have implemented additional safeguards including enhanced monitoring, enhanced access controls and further third-party review of our security practices,” Bertanelli added.
Monitor damage
Affected former students, including those who are now adults, are eligible for 24 months of free identity protection services and, if identity theft occurs, identity recovery assistance.
Officials said parents and guardians may consider applying for a free credit freeze for children under 16 to help prevent unauthorized accounts from being opened in their children’s names.
Officials also warned to “be wary of unexpected emails, phone calls or text messages related to this incident,” including claims that the caller is from ETS, the government or a credit monitoring company.
“Do not provide Social Security numbers, passwords, financial information, or other sensitive personal information in response to unsolicited requests.”
Additional information and updates can be found on the CDE Educational Testing Services events page.
Other Notable Education Hacks
In May, a massive cyberattack caused chaos at the University of California after hackers breached the company behind Canvas. Canvas is one of the most widely used edtech platforms in the United States, where reading assignments are posted, tests are administered, and students chat with teachers.
The leak caused Instruct to temporarily shut down Canvas and disrupted courses, assignments and final preparations for hundreds of thousands of students and professors as hackers threatened to leak their personal data.
A hacker group called ShinyHunters claimed responsibility for the attack. Instruct eventually announced a deal with “the unauthorized actor involved” to return the compromised data, but did not reveal who the actor was or whether payment was involved. It said it had obtained evidence that copies of the material had been destroyed, but admitted it could not be certain.
The most publicized hack of a local school district was the 2022 Labor Day weekend cyber attack on Los Angeles Unified.
District officials took the unprecedented step of shutting down all district computer systems to limit the damage. Schools reopened as scheduled on Tuesday, but students, families and staff had to reset more than 600,000 passwords. Many people said an entire week of guidance was missing, with technicians finding “digital tripwires” left behind, further infecting systems. The most severe damage occurred in the Facilities Department, where about half of its servers were encrypted, meaning district staff could not access their own systems and records.
The district confirmed the ransom demand but refused to pay.
The school district initially downplayed the harm caused by the leak. police officer. Alberto Carvalho said there was “no evidence of widespread impact” and called those affected “outliers”.
But a New York Times review of leaked documents uncovered student psychological evaluations from 2005, although the district denied that such records had been leaked. It also uncovered employee disciplinary records, workers’ criminal records reports, contractor payroll information, tax forms and passports. A district document later filed with the state acknowledged that more than 500 employees working for district contractors may have exposed Social Security numbers and other confidential information. The district also later reported that it had released approximately 2,000 student evaluation records, including those of 60 current students.