CALIFORNIA STUDENT DATA BREACH EXPOSES SENSITIVE RECORDS AFTER ATTACK ON STATE EDUCATION CONTRACTOR

SACRAMENTO, CALIFORNIA — California education officials have begun notifying students and families following a cybersecurity breach involving Educational Testing Service (ETS), a contractor responsible for administering statewide student assessments. An unauthorized individual accessed and copied sensitive records involving current and former public school students, including personal identification details, educational records, disability information, and testing data.

The California Department of Education (CDE) confirmed the incident in an October 16, 2026, announcement, identifying an intrusion into an ETS-operated secure file transfer system used to exchange assessment information with the state. The unauthorized activity extended over nearly four months, from May 22 through September 18, before ETS detected the breach on September 25.

The exposed information includes records covering students enrolled during the previous three school years. The affected population also extends to certain former students who left California public schools as far back as 2006 without a confirmed transfer to another school.

ETS is a nonprofit educational assessment organization contracted by California to support the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC). These testing programs collect information necessary to register students, administer examinations, evaluate academic performance, and document educational services.

The compromised system contained student information gathered through those statewide programs. Investigators determined that an unauthorized party obtained access through a compromised login credential associated with a secure file transfer protocol (SFTP) site.

According to California’s official incident notice, the exposed information varies by individual but may include names, dates of birth, residential addresses, school names, school districts, grade levels, and student identification numbers. The files also contained demographic details, including gender, race or ethnicity, primary language, country of origin, and English learner status.

Additional records involved disability and Section 504 status, testing accommodations, and primary disability classifications. Section 504 of the Rehabilitation Act provides protections for students with disabilities, making these records particularly sensitive because they can disclose information about an individual’s educational support requirements.

The compromised files also included information concerning participation in federal and state-supported educational programs. These records may identify students receiving services under Title I, including programs supporting economically disadvantaged students and migrant children, as well as students eligible for assistance under the McKinney-Vento Homeless Assistance Act.

Military-connected student status was another category potentially included in the exposed records. Depending on the individual, the copied information could also contain English language proficiency results, statewide assessment registration details, examination participation records, and academic performance results.

Not every affected student’s record contained all of these categories. The state emphasized that the information involved differed according to each student’s circumstances and the data maintained by the assessment contractor.

The California Department of Education confirmed that Social Security numbers, driver’s license numbers, passport numbers, financial account details, credit or debit card information, and account passwords were not involved. Parent and guardian personal information was also excluded from the compromised records, according to the state’s investigation.

Following discovery of the intrusion, ETS disabled the compromised account and took the affected file transfer system offline. The organization subsequently began constructing a replacement SFTP platform with additional security controls rather than immediately restoring the compromised service.

ETS also retained external cybersecurity specialists and coordinated with law enforcement to investigate the unauthorized access, evaluate the exposed records, and determine whether the information had been distributed beyond the original intrusion.

According to the state’s October 16 statement, ETS has taken measures intended to reduce the possibility that the stolen records will become publicly accessible. The contractor reported that its continuing monitoring had not identified evidence that the information had been publicly released.

The identity of the attacker has not been publicly established. California officials have not announced an arrest, identified a responsible criminal organization, or disclosed a confirmed motive for the intrusion.

The breach has also disrupted certain educational operations. In an October 2 notification to county and district superintendents and charter school administrators, Deputy Superintendent of Public Instruction Mary Nicely confirmed that ETS had suspended normal enrollment data processing and paused some testing activities while the affected systems underwent security evaluation.

The California Cybersecurity Integration Center is assisting with digital forensic analysis and incident response. The California Department of Technology and Governor’s Office of Emergency Services are providing additional technical, legal, and operational support.

The Department of Education and State Board of Education are examining ETS’s compliance with applicable data security requirements and contractual obligations. No official finding of a contractual violation has been announced, and the investigation has not established whether the compromised credential resulted from an internal security failure, theft through an external system, or another method of exposure.

Notification efforts began October 16 and are expected to continue through early November. ETS, under the state’s direction, is contacting affected current and former students and their families to explain the incident, identify the categories of information involved, and provide information about available assistance.

The notifications are being made available in 27 languages, reflecting the diverse population served by California’s public education system.

ETS is providing affected students with 24 months of complimentary identity-protection services through Experian IdentityWorks. The services are available to eligible minors through their parents or legal guardians and to former students who are now adults.

The enrollment deadline is March 19, 2027. According to the official notice, no credit card is required to activate the complimentary protection. Identity-restoration assistance is also available to eligible affected individuals for 24 months following notification.

The state cautions that not receiving a notification does not conclusively establish that a student’s information was unaffected. Some former students may no longer have current contact information on file, making it difficult to reach everyone whose records were included.

Officials are encouraging families to remain alert to unexpected emails, telephone calls, and text messages that reference student assessments, schools, educational records, or identity-protection services. Individuals should verify the legitimacy of communications before providing personal information or attempting to enroll in assistance programs.

Parents and guardians may also consider requesting credit freezes for eligible minors, while adults can review their credit reports and use available fraud-alert and security-freeze protections.

California has established a dedicated assistance line at 833-931-8488, available Monday through Friday from 6 a.m. to 6 p.m. Pacific Time, for questions about the incident and identity-protection services.

---

---

California Department of Education, ETS Begins Notifying California Students and Families Following Data Security Incident. News Release No. 26-45, October 16, 2026. (Free Download)

---

---

---

California Department of Education, Educational Testing Service (ETS) Incident. Official Incident Notices and Frequently Asked Questions, last reviewed October 16, 2026. (Free Download)

---

---

---

California Department of Education, Educational Testing Service (ETS) Incident Letter. Official correspondence from Mary Nicely, Deputy Superintendent of Public Instruction, October 2, 2026. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---