California student breach: millions of students' data copied from testing contractor ETS
The California Department of Education said on October 16, 2026 that an unauthorised party used a compromised login credential to copy student files from Educational Testing Service's file-transfer site between May 22 and September 18, 2026, covering all students enrolled in the three previous school years.
What happened
Educational Testing Service (ETS), the non-profit contractor that administers California's statewide assessments, identified unauthorised activity on September 25, 2026 involving a secure file transfer protocol (SFTP) site it uses to exchange statewide assessment information with the California Department of Education (CDE). The investigation determined that an unauthorised party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026. ETS disabled the account involved, took the site offline, and later built an entirely new SFTP site with enhanced security controls. CDE announced the breach publicly on October 16, 2026, and ETS began notifying students and their families the same day, with notifications expected to continue through early November.
Who is affected
All students enrolled in California public schools in the three previous school years, plus some former students dating back to 2006 — more than 5.7 million students were enrolled in the 2025–2026 school year alone, and neither ETS nor CDE has published a total count. The copied information varies by student and may include names, dates of birth, residential addresses, grade levels, schools and districts, statewide and local student ID numbers, gender, race or ethnicity, country of origin, primary language, English learner status and proficiency information, statewide assessment data, disability status, testing accommodations, primary disability type, Section 504 status, and eligibility for certain federal programs. According to CDE and ETS, Social Security numbers, driver's licence and passport numbers, financial account information, credit and debit card information, passwords, and parent or guardian information were not accessed, and ETS says it has not found evidence that the information has been made public so far.
How serious
The concrete risk is targeted impersonation of schools and long-lived identity misuse: a child's name, birth date, home address, school and disability status in one file is enough to build fake school, district or testing messages that get the personal details right, and statewide student IDs do not change the way a password can. Children's records can be misused years later, and most children have no credit file or monitoring habit that would catch it early. The absence of Social Security numbers and financial data limits immediate account takeover and card fraud — the danger here is convincing phishing aimed at families and identity misuse that surfaces long after the headlines.
What to do now
If a notice letter arrives, keep it: it carries the enrollment details for two years of free Experian IdentityWorks identity-protection services, and enrollment closes on March 19, 2027 — a parent or legal guardian enrolls a minor. Notifications run through early November, so not having a letter yet does not settle whether a student is included. Treat unexpected calls, texts or emails that cite a child's school, testing or this breach as suspect, and contact the school or district through a number or site you already know rather than any link or number in the message.