A data breach involving a contractor for the California Department of Education (CDE) has exposed sensitive student information, potentially affecting all students enrolled in the state’s public schools since 2023.
The incident occurred at Educational Testing Service (ETS), a nonprofit organisation contracted by California to administer statewide educational assessments.
- A cybersecurity breach involving Educational Testing Service (ETS) potentially affected every student enrolled in California public schools since 2023.
- Hackers used compromised login credentials to access and copy student records between May 22 and September 18, 2026.
- Exposed information may include names, addresses, disability status, demographic records and assessment results. Not receiving a notification does not rule out exposure.
ETS discovered suspicious activity on September 25, 2026. An investigation found that an unauthorised party had used compromised login credentials to access and copy files containing student information over nearly four months, from May 22 through September 18.
The breach potentially affects current and former students, although the categories of information exposed vary by individual.
What student information was exposed in the California data breach?
According to the California Department of Education, the compromised records may include students’ names, dates of birth, residential addresses, schools, districts and grade levels.
The affected data also includes Statewide Student Identifiers (SSID), local student identification numbers and demographic information such as gender, race or ethnicity, primary language, country of origin and English learner status.
More sensitive records potentially exposed include disability and Section 504 status, testing accommodations, primary disability classifications and eligibility for federal education programmes.
These programmes include Title I, Part A, Title I, Part C, McKinney-Vento and Military Connected Student.
English language proficiency information and statewide assessment registration, participation and results may also have been accessed.
Officials emphasised that not every student’s record contained all these categories of information.
ETS data breach notifications sent to affected students
ETS is notifying affected students and families about the security incident. The California Department of Education cautioned that the absence of a notification letter does not necessarily mean a student’s information was unaffected.
The breach involved access through a compromised login credential, allowing the unauthorised party to retrieve and copy student files over an extended period.
The incident raises concerns about the exposure of personal and educational records held by third-party contractors, particularly information relating to minors, disabilities and participation in government education programmes.
California officials have confirmed that student information was copied, although the full extent of the exposure may differ between individual records.
