Hack exposes data on millions of California students

Overview

Updated Oct 21

An attacker used a stolen login to copy California student files from an Educational Testing Service server for nearly four months, from May 22 to September 18; ETS did not detect the activity until September 25. The files hold names, addresses, birth dates, and disability status for about 7 million students from the past three school years, and some former students' records go back to 2006.

California began mailing notices on October 16 and will keep sending them through November. ETS took the breached file-transfer site offline and built a new platform, and it paused some testing activities while it assesses security. The company is offering two years of free identity protection through Experian, and the state is reviewing whether ETS met its data-security contract.

Why it matters

An attacker holds personal data on roughly 7 million California students, and the deadline to sign up for free identity protection is March 19, 2027.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

≈7M

Students affected

Every student enrolled in California public schools over the past three school years had data copied; some former students' records date back to 2006.

Voices

Curated perspectives — historical figures and your fellow readers.

Organizations Involved

Educational Testing Service (ETS)

Nonprofit assessment organization

Paused some testing while it assesses system security; offering two years of free identity protection

The nonprofit that administers California's statewide standardized tests; its secure file-transfer server was breached.

California Department of Education (CDE)

State agency

Sending breach notices through November; reviewing ETS compliance

The state agency that oversees California's public schools and contracts with ETS for statewide assessments.

Timeline

May 2026 October 2026

5 events Latest: October 16th, 2026 · 4 weeks ago

Tap a bar to jump to that date

October 2026
California discloses the breach
Latest Disclosure

CDE and ETS announce the breach and begin notifying students and families.
October 16th, 2026
District leaders notified
Disclosure

ETS sent a letter to county and district school officials stating it had stopped normal enrollment data processing; districts got word of the incident two weeks before the public notice.
October 2nd, 2026
September 2026
ETS detects the breach
Investigation

ETS disables the compromised account, takes the file-transfer site offline, and opens an investigation.
September 25th, 2026
Copying ends undetected
Intrusion

The attacker's last file copying occurs; the intrusion goes unnoticed for another week.
September 18th, 2026
May 2026
Attacker begins copying files
Intrusion

An unauthorized party uses a stolen login to copy California student files from the ETS server.
May 22nd, 2026

Scenarios

Stolen student data resurfaces or is used in identity fraud

Uncertain Resolves by Mar 19, 2027

Discussed by: ETS and California officials, who say ongoing web monitoring has found no public release of the data so far

ETS says it has seen no evidence the copied files were made public, and law enforcement is investigating. If the data emerges on the dark web or drives identity-theft reports, the risk to minors shifts from potential to concrete. The original file-transfer site has been replaced with a new system. Families have until March 19, 2027 to enroll in the free two-year identity monitoring.

California penalizes ETS over testing breach

Possible Resolves by End of 2027

Discussed by: California Department of Education, which is reviewing ETS's compliance with data-security and contractual requirements

The state is examining whether ETS met its data-security obligations under the testing contract. If the review finds failures, California could impose penalties, demand corrective action, or eventually move the testing contract elsewhere. The state's settlement with the education-software firm Illuminate over a student-data breach shows enforcement is a live option.

Class action over ETS breach settles or is dismissed

Possible Resolves by Q2 2028

Discussed by: Pattern set by the Illuminate Education case, which ended in state enforcement and a $5.1 million settlement

Affected families may file a class action over the exposure of minors' personal data. The outcome depends on whether misuse of the data is ever proven. If no harm surfaces, courts may dismiss the claims; if fraud emerges, a settlement becomes more likely. A ruling, settlement, or dismissal would need to appear in court records within a two-year window.

Historical Context

One moment from history that rhymes with this story — and how it unfolded.

2021

Illuminate Education student data breach (2021)

Illuminate Education, an educational technology company whose products were used in California schools, suffered a data breach in 2021 that exposed the information of millions of students, including California students across 49 school districts.

Then

California, Connecticut, and New York secured a combined $5.1 million settlement, with California receiving $3.25 million.

Now

The case became California's first enforcement action under the K-12 Pupil Online Personal Information Protection Act (KOPIPA), which sets data rules for online services used in schools.

Why this matters now

It shows California has tools to penalize contractors that mishandle student data, a path state officials may follow with ETS.