Hackers Steal Data of Nearly 7 Million California Students in Massive School Testing Breach

SACRAMENTO, California — Hackers have stolen the personal information of nearly 7 million California public school students in one of the largest education data breaches in American history, state officials announced Friday, October 16.

The California Department of Education said the breach targeted Educational Testing Service (ETS), the nonprofit contractor that administers the state's standardized tests. Stolen files contained student names, birth dates, home addresses, demographic details, disability status, unique student ID numbers, and the schools and districts students attend. All students enrolled in California public schools over the past three years were affected — a number that reaches well beyond the state's current 5.7 million public schoolers because former students are included too. Students who left California without confirming a transfer to another school were also caught up in the theft, some dating back to 2006.

According to the state education department, ETS identified unauthorized activity on a secure file transfer (SFTP) site used to exchange statewide assessment data on September 25, 2026. Investigators determined that an unauthorized party used a compromised login credential to access the site and copy files containing student information at various times between May 22 and September 18, 2026 — a window of nearly four months.

ETS disabled the compromised account, took the affected file transfer site offline, and launched an investigation with outside cybersecurity experts. The nonprofit began notifying students and families on Friday, October 16. District and county school leaders had been quietly warned earlier, in an October 2 letter stating that ETS had stopped "normal enrollment data processing."

"The CDE is actively working to minimize disruption and resume affected assessment activities in a timely manner," the department said in that letter, according to state officials.

State officials stressed two points that may ease the worst fears: Social Security numbers and sensitive financial information were not accessed, and ETS has so far found no evidence that the stolen information has been made public.

Still, the scope of what was taken is alarming. Beyond names and addresses, the exposure included student grade level, date of birth, gender, race or ethnicity, primary language, country of origin, English-learner status, disability information, and eligibility status for federal programs serving low-income families.

ETS manages California's statewide assessments, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC) — meaning nearly every student who took the state's mandated tests is in the stolen files.

California education officials said they are working with a team of state agencies to investigate and determine the full scope and impact of the incident, according to a letter from state Deputy Superintendent Mary Nicely.

Sources

• Reuters
• New York Post