SACRAMENTO, October 17, 2026 — Millions of current and former students in California may have had their personal information exposed after a hacker gained access to a California Student Data from computer system operated by a nonprofit organisation responsible for administering statewide school assessments.
The California Department of Education confirmed that an unauthorised individual accessed and copied student records maintained by Educational Testing Service (ETS), which provides testing services under contract with the state. The incident has raised concerns about the protection of children’s personal information and the security of sensitive data handled by third-party education providers.
The compromised information may include students’ names, dates of birth, residential addresses, school details, demographic characteristics, disability status and academic assessment records. The precise information involved varies between individuals, and not every affected record contains all the listed categories.
California had more than 5.7 million students enrolled in its public schools during the 2025–2026 academic year, illustrating the potential scale of the incident.
State officials said the information of students enrolled during the three preceding school years was accessed and copied. The affected population may also include certain former students whose records were retained by the education system.
Compromised Credentials Enabled Unauthorised Access to California Student Data
The California Student Data breach involved a secure file transfer protocol site operated by ETS and used to exchange student assessment information with California education authorities.
Investigators determined that an unauthorised individual used compromised login credentials to access the system and copy files on multiple occasions between May 22 and September 18, 2026.
ETS identified suspicious activity on September 25 and subsequently launched an investigation with external cybersecurity specialists. The discovery prompted the organisation to disable the affected account and take the compromised file-transfer site offline.
The company has since established a replacement system with enhanced security controls and is assessing additional measures to reduce the possibility of another incident.
The length of time between the beginning of the unauthorised activity and its discovery has raised questions about the monitoring of systems used to transfer sensitive educational information. Investigators have not publicly established the identity of the person responsible or explained how the login credentials were initially compromised.
Authorities are continuing to assess the incident and its implications for students, families and the state education system.
Sensitive Educational Information Among Exposed Records
The breach extends beyond basic contact information. Depending on the individual record, the compromised files may contain student identification numbers, language proficiency information, testing results, disability classifications and details about participation in certain educational assistance programmes.
Such information can reveal personal circumstances that students and families would reasonably expect educational institutions and their contractors to protect.
Disability-related records and demographic information present particular privacy concerns because they can expose details about a child’s educational needs and background. The combination of names, birth dates, addresses and school information could also increase the risk of targeted scams or attempts to impersonate legitimate organisations.
However, officials have drawn a distinction between information that was accessed and information that may have been misused. The investigation has not established that the stolen records were subsequently published online.
The education department said monitoring had not identified evidence that the information had been made publicly available as of its latest update.
Officials also confirmed that Social Security numbers, financial account information, passwords and parents’ or guardians’ personal information were not involved in the incident.
The absence of those categories reduces certain risks but does not eliminate the potential consequences of exposing other personal and educational records.
Notifications and Identity Protection Measures
ETS began notifying affected California Student Data and families on October 16, with notifications expected to continue through early November. The California Department of Education is coordinating with state cybersecurity authorities and the testing contractor to communicate the findings and provide information about available assistance.
Eligible affected individuals are being offered two years of identity-protection services through Experian IdentityWorks at no cost. The notification process is intended to explain which information may have been involved and what steps individuals can take to protect themselves.
Families are advised to review official communications carefully and remain alert to unexpected messages requesting personal information. Notifications should be verified through official education department channels, particularly because data breaches can create opportunities for fraudulent emails, calls and text messages.
The state is also reviewing the incident and the contractor’s compliance with applicable security obligations. Cybersecurity specialists and law enforcement agencies are involved in the response.
The episode underscores the risks associated with outsourcing the handling of sensitive public-sector information. Education contractors often require access to substantial volumes of student records to administer assessments and maintain testing systems. That access creates responsibilities to protect information throughout its collection, transfer, storage and use.
For California Student Data , the immediate priorities are identifying affected individuals, limiting further exposure and strengthening safeguards around the systems used to manage student data.
The investigation remains ongoing, and the full consequences of the breach have yet to be determined. While officials have not found evidence that the copied information was publicly released, the incident highlights the importance of robust access controls, continuous monitoring and clear accountability when organisations handle children’s personal information.
Also Read :- Tesla Wins Appeals Court Challenge as Self-Driving Lawsuit Faces New Legal Hurdle
