Millions of current and former California public school students have had sensitive personal information stolen after attackers compromised a system operated by Educational Testing Service (ETS). The breach affected student records collected over several years, including information about disabilities, academic performance, and family circumstances.
The California Department of Education disclosed the incident on October 16, 2026. Officials confirmed that the stolen information covers students enrolled during the previous three school years, with some records involving former students dating back to 2006. Approximately 5.7 million students attended California public schools during the latest academic year alone.
Investigators traced the intrusion to a compromised login credential used to access an ETS secure file transfer system. The platform allowed the testing provider and state education officials to exchange assessment information, but the stolen credentials gave an unauthorized individual access to files containing student data.
According to the department, the attacker copied information on multiple occasions between May 22 and September 18, 2026. ETS discovered suspicious activity on September 25, meaning the unauthorized access continued for nearly four months before being detected.
The compromised records may include names, home addresses, birth dates, school information, student identification numbers, and academic assessment results. Some files also contain demographic details, language proficiency information, disability classifications, testing accommodations, and eligibility for educational assistance programs.
ETS emphasized that Social Security numbers, financial account details, payment card information, passwords, and parent or guardian information were not included in the stolen files.
Following the discovery, ETS disabled the compromised account and shut down the affected file transfer system. The organization subsequently built a replacement platform with stronger security controls and engaged external cybersecurity specialists to investigate the incident.
The disruption also affected normal processing of student enrollment information used for statewide assessments. ETS said it was working to restore services while strengthening monitoring and access restrictions.
Although the stolen records contain sensitive information, ETS reported finding no evidence that the data had been publicly released. Authorities have not identified the attacker or explained how the original login credentials were compromised.
Notifications to affected students and families began on October 16 and are expected to continue through early November. ETS is offering two years of complimentary identity-protection services through Experian IdentityWorks.