California Data Breach Exposes Millions of Student Records
Millions of current and former California public school students may have had their sensitive personal information compromised in a major data breach involving Educational Testing Service (ETS), a contractor for the state. The breach has raised serious questions about the security of student records and who has access to them.
Hackers gained unauthorized access to sensitive records, which include home addresses, birth dates, and details about disabilities. Families should be aware that even if they have moved out of California, they could still be affected if their child previously attended a public school in the state.
The breach was discovered when ETS detected suspicious activity on September 25, 2026, leading to the disabling of the compromised account and the shutdown of the affected file transfer site. Investigators found that the attacker had used a compromised login credential to access the system and copied files containing student information between May 22 and September 18, 2026.
ETS has since implemented stronger security measures and is working with cybersecurity specialists to investigate the breach. While the organization has reported no evidence that the stolen information has been made public, the risk remains that sensitive student records could be misused.
The compromised data includes not only academic records but also personal details that could potentially identify students or reveal their family circumstances. Fortunately, the stolen files did not contain Social Security numbers or financial account details, but the presence of disability information raises additional privacy concerns.
Impact on Affected Students and Families
The breach affects a wide range of individuals, including those who attended California public schools in the last three years and former students whose records may date back to 2006. This means that many families, even those now living far from California, could be impacted by this incident.
ETS has begun notifying affected individuals and families, with notifications expected to continue through early November. The notifications will detail the types of information involved and provide instructions for accessing complimentary identity protection services. However, families should note that not receiving a notification does not guarantee their information is safe, as some former students may have outdated contact information.
To mitigate the risks associated with the breach, ETS is offering 24 months of free identity theft protection for affected individuals. This service aims to help monitor for potential identity theft and provide assistance if personal information is misused. Families are encouraged to take advantage of this offer and remain vigilant about their personal information.
Intelligence Reviewed
As the investigation continues, the California Department of Education and other state agencies are reviewing ETS's compliance with data security requirements. The situation underscores the importance of safeguarding sensitive student information and raises questions about how long such records should be retained after a student leaves the system.
In light of this breach, families are advised to be cautious of potential scams that may arise, as scammers often exploit real data breaches to send fraudulent communications. It is crucial to verify any messages claiming to be from ETS or related organizations and to follow official channels for information and assistance.
