On Friday, October 16, the California Department of Education said a hacker accessed the data of millions of students by exploiting the system of a nonprofit contractor that works with the state. The exposed data includes names, birth dates, addresses, and disability status.
According to the department, the hacker got into the data of “all students enrolled in the three previous school years.” More than 5.7 million students were enrolled in California during the 2025-2026 school year alone. The department did not give a three-year total, so the full number is likely higher.
Reuters reported that “an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026.” The compromised system was a secure file transfer (SFTP) site run by Educational Testing Service, the nonprofit that administers California’s statewide assessments. ETS discovered the breach on September 25 and began notifying students and families on October 16.
What was exposed, and what was not
The confirmed exposed data: student names, birth dates, home addresses, and disability status. That combination is enough to build convincing phishing messages aimed at families, even though it falls short of full identity theft.
What was not taken matters just as much. Social Security numbers and sensitive financial information were not accessed, the department said. ETS has also said it has not found any of the stolen information published publicly so far. That means the immediate risk is targeted scams, not someone opening credit cards in a child’s name.
What should California parents do right now?
If your child attended a California public school in the last three years, watch for the breach notification from Educational Testing Service, treat unexpected messages about your child’s school records as suspicious, and talk to your kids about phishing. No SSNs were taken, so a credit freeze is not urgent, but vigilance is.
- Watch your mail and email for the official breach notification from Educational Testing Service.
- Treat any unexpected message about your child’s school records, testing, or enrollment as suspicious.
- Do not click links in texts or emails claiming to be about the breach; go to the school district site directly.
- Talk to your kids about phishing, since student names and birth dates make scam messages look real.
- Consider a free minor credit freeze if you want maximum protection, even though no SSNs were exposed.
What ETS and California are doing
ETS told Reuters it has “implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices.” The company said its priority remains the students, families, and educators it serves.
The breach had already disrupted testing operations before it was disclosed. In an October 2 letter to county and district officials, the education department said the testing service had stopped “normal enrollment data processing” and that it was “actively working to minimize disruption and resume affected assessment activities in a timely manner.”
No ransomware group has claimed responsibility, and the department described the intruder only as a hacker or unauthorized party. No free credit monitoring or identity protection offer has been reported so far.
