Data on Millions of California Students Copied From Educational Testing Service Site, Officials Say

An unauthorized party used a compromised login credential to copy records on millions of current and former California public school students from a file-transfer site run by the state's testing contractor, Educational Testing Service (ETS), state education officials said Friday, Oct. 16. The access happened at various times between May 22 and Sept. 18, 2026.

The files include names, birth dates, home addresses and, for some students, disability status. Notices to families began going out Oct. 16 and are expected to continue through early November, the California Department of Education (CDE) said.

What happened

The data breach came to light Sept. 25, when ETS spotted unauthorized activity on a secure file transfer protocol (SFTP) site used to exchange testing data with CDE, according to a notice ETS issued at the direction of CDE and filed with the California attorney general. ETS says it disabled the account, took the site offline and began an investigation with outside cybersecurity experts, which found that a compromised login credential had been used to copy student files.

ETS is a nonprofit assessment organization under contract with the state to give California's required tests, including the CAASPP and ELPAC exams, according to CDE.

Who and what was affected

The notice says information on "all students enrolled in the three previous school years" was accessed and copied. CDE's FAQ says affected people include students enrolled from 2023 through the current school year, plus students who left a California school since 2006 without confirming a transfer to another school.

The California Department of Education's posted notice, FAQ and news release do not give a total, as of 1 p.m. ET Saturday, Oct. 17. Politico reported that the breach exposed data on all 7 million students enrolled in California public schools over the past three school years, attributing that figure to CDE. California enrolled more than 5.7 million students in 2025-26 alone, according to CDE figures cited by Reuters. That is one year's enrollment, not a count of people affected. The Los Angeles Times reported that the breach affects many more than the state's current 5.7 million students because it reaches back to 2023 enrollments and to some former students.

The data varies by student but may include:

• Name, birth date, home address, school, district and grade
• Statewide and local student ID numbers
• Gender, race or ethnicity, primary language, country of origin and English learner status
• Disability and Section 504 status, testing accommodations and primary disability type
• Eligibility for Title I, Part A; Title I, Part C (migrant education); McKinney-Vento (homeless education); and military-connected student programs
• English language proficiency information and state test registration, participation and results

Social Security numbers, driver's license and passport numbers, financial account and card information, and account passwords were not included, and no parent or guardian information was involved, the notice says.

ETS says its regular web monitoring has "not uncovered any evidence that the information has been made public" so far, and that after working with law enforcement and cybersecurity experts it has "taken steps to reduce the potential risk of the data being made publicly accessible". The notice does not say who was responsible or whether a ransom was demanded. The Los Angeles Times also noted that the official release did not address a ransom.

When families were told

CDE told county and district superintendents and charter school administrators about "an incident involving ETS-operated systems" in an Oct. 2 letter from Deputy Superintendent of Public Instruction Mary Nicely. The letter said CDE and the State Board of Education "are urgently working with a team of state agencies to investigate and determine scope and impact of the incident, including what information may have been affected." It also said ETS had halted normal enrollment data processing and paused certain testing activities while its systems were assessed.

The first public notice came Oct. 16, three weeks after ETS detected the activity. The notice says law enforcement was told but that its investigations "have not delayed this notice".

What each side says

ETS says it built an entirely new SFTP site with enhanced security controls and is evaluating further measures. In statements to Reuters and the Los Angeles Times, ETS said it had "implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices". ETS spokesperson Christine Betaneli told the Times that "ETS maintains a comprehensive information security program that is regularly assessed by third parties" and that no other "ETS customers" were affected.

The California Cybersecurity Integration Center is helping with digital forensics and incident response, with support from the California Department of Technology and the Governor's Office of Emergency Services. CDE and the State Board of Education say they are reviewing the incident and ETS's compliance with data-security and contract requirements.

Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute, told the Los Angeles Times: "A stolen login credential should not become a months-long passport to millions of students' personal records." He added that, if that is what happened, "the critical question is why authentication safeguards, access restrictions, and monitoring systems failed to detect and stop the unauthorized activity".

Why it matters

The files did not include Social Security numbers. But they can link students' names and home addresses with sensitive details such as disability type and eligibility for homeless-education and migrant-education programs.

What parents and students can do

ETS is providing 24 months of Experian IdentityWorks identity-protection services at no cost to affected current and former students, according to CDE:

• Under 18: A parent or legal guardian can enroll the student in Experian IdentityWorks Minor Plus.
• 18 and older: Affected adults, including former students, can enroll directly in Experian IdentityWorks.
• Deadline: The notice and CDE's FAQ set an enrollment deadline of March 19, 2027, for both products. One attachment to the posted notice lists March 19, 2029, for the adult activation code; CDE has not explained the difference, so families should follow the date in their own notice or confirm with the call center. Minors who turn 18 before March 19, 2029, may enroll in the adult product on turning 18, CDE says.
• Cost: Enrollment is free, and no credit card is required.
• How: Enrollment instructions, including the website and activation code, are provided with the notification, which CDE posts in 27 languages; details are at cde.ca.gov/ets.
• Questions: Call 833-931-8488, Monday through Friday, 6 a.m. to 6 p.m. Pacific time, excluding major U.S. holidays. TTY users can call 711.

Experian identity restoration help for eligible people who experience identity theft is available for 24 months from the date of the notification and does not require enrolling in monitoring, CDE says. Not receiving a notification "does not necessarily mean" a student's information was unaffected, particularly if contact information has changed, the FAQ adds.

CDE also suggests parents consider a free credit freeze for children under 16 and warns families to be cautious of unexpected calls, texts or emails claiming to be from ETS, CDE or Experian.