Millions of California students' personal data stolen as hackers copied files from a testing contractor for months

Millions of current and former California public school students may have had sensitive personal information stolen in a massive data breach involving a state testing contractor, officials say. Hackers copied records from a secure file transfer site operated by Educational Testing Service (ETS), a nonprofit that works with the California Department of Education. The stolen information includes home addresses, birth dates and even details about disabilities.

ETS helps administer statewide student assessments for the California Department of Education and maintains information connected to those tests. According to state officials, someone gained unauthorized access to an ETS-operated secure file transfer site using a compromised login credential. Investigators determined that the intruder copied files containing student information at various times between May 22 and September 18, 2026.

ETS discovered the suspicious activity on September 25. The company disabled the affected account, took the file transfer site offline and brought in outside cybersecurity specialists to investigate. ETS says it has since built a replacement system with stronger security controls. So far, the company reports finding no evidence that the stolen information has been made publicly available, but investigators have confirmed that someone accessed and copied the records.

The compromised files contained far more than test scores. Depending on the student, the files may contain information that could help someone identify a child or learn personal details about their family circumstances. Some records also identified whether a student qualified for programs serving children experiencing homelessness or other educational needs. Officials say the stolen files did not contain Social Security numbers, financial account details, driver's license numbers, passwords or parent and guardian personal information.

The most troubling aspect is the scope. According to the California Department of Education, the compromised information includes records covering all students enrolled during the previous three school years. It also extends to a group of former students who left California public schools as far back as 2006 and whose transfers to another school were never confirmed with the department. A child who attended elementary school in Los Angeles before the family moved to Texas could therefore still have old records among the stolen files.

California has roughly 5.7 million public school students, and because the compromised files span multiple school years, millions of people are potentially involved. Officials have not yet released a final count of unique affected individuals. ETS confirmed that no other ETS customers were affected by the incident; the risk to families now living elsewhere comes only from their past connection to California's public schools.

The California Department of Education and the State Board of Education are coordinating with cybersecurity specialists and other state agencies. The California Cybersecurity Integration Center is assisting with the technical investigation, and state officials are reviewing ETS's compliance with applicable data security requirements and its contractual obligations.

In a statement, ETS said: 'We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices.' The company says it continues monitoring for signs that the stolen information has surfaced publicly.

ETS began notifying affected students and families on October 16, 2026, and notifications are expected to continue through early November. The letters and emails explain the incident, identify the types of information involved and include instructions for enrolling in complimentary identity-protection services.

ETS is offering affected current and former students 24 months of free identity theft protection. Parents or legal guardians can enroll eligible children under 18, while adults, including former students, can enroll themselves; the enrollment deadline is March 19, 2027, and no credit card is required. Identity restoration assistance is also available to eligible individuals for 24 months from their notification date, even without enrolling in monitoring services. Officials caution, however, that not receiving a notification does not necessarily mean a family's information is safe, because some former students may have outdated contact information on file.