Millions of current and former California public school students have had their personal information stolen in one of the largest student data breaches in recent memory. The breach happened at Educational Testing Service (ETS), the nonprofit that runs statewide testing for California, including the required Smarter Balanced exams.
The California Department of Education (CDE) announced the breach on October 16 and began notifying affected families the same day. Notifications are expected to continue through early November.
What Happened
According to the Los Angeles Times, as republished by Education Week, an unauthorized person used a compromised login credential to access a secure file transfer site operated by ETS. Between May 22 and September 18, 2026, that person copied student files.
ETS discovered the hack on September 25, and California district leaders were notified on October 2.
The scale is enormous. California has about 5.7 million current public school students, but the breach goes well beyond that. It reaches back to students enrolled since 2023, and as far back as 2006 for students who left California without a confirmed transfer to another school.
What Information Was Taken
The exposed data varies by student, but it may include:
- Names and home addresses
- Dates of birth
- Grade level, school and district
- Statewide Student Identifier numbers
- Gender, race or ethnicity, primary language and country of origin
- English learner status
- Disability records and participation in special programs
- Eligibility for federal programs, such as those for low-income families
- Statewide test information
Officials say the breach did not include Social Security numbers, driver’s license or passport numbers, financial account or card information, passwords, or any personal information about parents or guardians.
Has the Data Been Released?
So far, officials say there’s no evidence that the stolen information has been posted publicly. ETS said it has been working with law enforcement and cybersecurity experts and regularly monitoring the web.
Still, the attacker hasn’t been identified. The Los Angeles Times noted that hackers sometimes hold data back while demanding a ransom, and officials didn’t say whether a ransom demand had been made.
How ETS and the State Responded
ETS took the affected file transfer site offline and built a new one with stronger security controls, according to the CDE. The company says it has also added enhanced monitoring, tighter access controls and a third-party review.
“ETS maintains a comprehensive information security program,” spokesperson Christine Betaneli said, adding that no other ETS customers were affected.
California Deputy Superintendent Mary Nicely said in a letter that officials “are urgently working with a team of state agencies” to understand the full scope and impact.
Some experts are asking tough questions. Anton Dahbura of the Johns Hopkins University Information Security Institute said a stolen login “should not become a months-long passport to millions of students’ personal records,” and asked why authentication safeguards and monitoring failed to catch the intrusion sooner.
What Families Should Do Now
If your child attends or attended a California public school, here are the key steps:
- Watch for your notice. Notifications started October 16 and will continue into November. The official ETS Notice of Data Breach is available in 27 languages on the CDE website.
- Sign up for free identity protection. Affected current and former students, including adults who have since graduated, can get two years of Experian IdentityWorks at no cost, plus help restoring their identity if it’s stolen.
- Consider a credit freeze for younger children. Parents and guardians can request a free credit freeze for children under 16, which stops anyone from opening accounts in a child’s name.
- Be alert for scams. Be cautious of unexpected emails, calls or texts about the breach, even if they claim to come from ETS, the state or a credit monitoring company.
- Never share sensitive details on request. Don’t give out Social Security numbers, passwords or financial information in response to unsolicited messages.
Updates are posted on the CDE’s ETS incident webpage at cde.ca.gov/ets.
Why Student Data Is a Target
Children’s information is especially valuable to criminals because it often goes unused for years. A child usually doesn’t check their credit until they apply for a loan, a credit card or their first apartment, which gives identity thieves plenty of time to misuse it.
This breach also includes sensitive details such as disability records and program eligibility, which families may not want shared even if they can’t be used directly for fraud.
Why It Matters
Schools depend on outside vendors for testing, learning apps and record keeping, and each of those companies holds valuable student data. The ETS breach shows how a single stolen password at one vendor can expose information about millions of children.
For parents, the lesson is to treat a child’s personal data like an adult’s: take the free protection on offer, consider a credit freeze, and stay alert for scams in the months ahead.
