California Student Data Breach Exposes Millions of Records

The California student data breach has exposed personal and educational information belonging to millions of current and former public school students. Attackers used a compromised login to access files held by Educational Testing Service (ETS), a contractor responsible for statewide assessments.

California’s Department of Education (CDE) announced the incident on October 16. According to the department, the affected records cover all students enrolled in California public schools during the past three years.

Some older records also relate to former students dating back to 2006. However, officials have not provided a final count of affected individuals.

Compromised Login Enabled Months of File Access

Investigators determined that an unauthorized party accessed the ETS file-transfer site between May 22 and September 18, 2026. During that period, the attacker copied files containing California student information on multiple occasions.

ETS discovered the unauthorized activity on September 25, a week after the last identified access.

The affected system used Secure File Transfer Protocol, or SFTP, to exchange statewide assessment information between ETS and the CDE. Although SFTP protects data during transfer, the compromised credential allowed the attacker to enter the system.

Following the discovery, ETS took the site offline. It also built a replacement with stronger security controls.

Exposed Records Include Disability and Assessment Information

The California student data breach involves a broad range of sensitive records. According to the CDE, the exposed information includes:

• Names, birth dates and home addresses.
• Grade levels, schools, districts and student identification numbers.
• Gender, race or ethnicity and country of origin.
• State assessment results and primary language.
• English learner status and language proficiency information.
• Disability status, primary disability type and testing accommodations.
• Section 504 status and eligibility for certain federal programs.

These records combine identifying details with information about students’ educational needs and backgrounds.

However, ETS said attackers did not access Social Security numbers, driver’s license numbers or passport numbers. The company also excluded financial account details, payment card information, passwords and parent or guardian information from the affected data.

As of October 16, ETS said it had found no evidence that anyone had publicly released the stolen information.

Notifications Continue Through Early November

ETS began notifying affected students and families on October 16. It expects that process to continue through early November.

The CDE is offering eligible current and former students two years of free identity-protection services through Experian IdentityWorks.

For context, California public schools enrolled more than 5.7 million students during the 2025–2026 academic year across over 1,000 districts. Nevertheless, that enrollment figure does not represent the final breach total because the affected records span multiple years.

Security Response Disrupts Assessment Processing

ETS administers the California Assessment of Student Performance and Progress and the English Language Proficiency Assessments for California.

On October 2, the organization informed county and district officials that it had stopped normal enrollment data processing. The interruption affected services supporting the state’s assessment programs.

Meanwhile, ETS said it had introduced additional monitoring, stronger access controls and further external reviews of its security practices.

The organization is working to restore services and limit disruption to assessment activities. Its response also includes replacing the compromised file-transfer environment with the newly secured system.