Hackers have stolen the data, including names, addresses and disability records, of millions of current and former California public school students who took state-mandated standardized tests that annually assess their academic proficiency, education officials announced Friday. The compromised information affects many more than the state’s 5.7 million current public school students, as the breach dates back to 2023 enrollment. Students who left California but did not confirm their transfer to another school were also affected, dating back to 2006. The data breach involved the Educational Testing Service, or ETS, which provides extensive services to California. While the first public notice was on Friday, school district leaders received the news on October 2. State education officials “are urgently working with a team of state agencies to investigate and determine the scope and impact of the incident, including what information may have been affected,” according to a letter from the state’s deputy superintendent. Mary Nicely.ETS, a nonprofit testing organization, helps administer and provide testing-related services for students enrolled in California public schools, including the required Smarter Balanced tests administered in the spring. In this role, ETS maintains student demographic, test participation, and assessment data. The information displayed also includes the student’s grade level, date of birth, and the school and district the students attend. The hackers also gained access to unique student identification numbers, as well as information about gender, race or ethnicity, primary language, country of origin, and English learner status. Information about students’ disabilities and students’ eligibility status for federal programs, such as those available to assist students from low-income families, was also discussed. The stolen data did not include Social Security numbers, driver’s license numbers, passport numbers, financial account information, credit or debit card information, or account passwords. The personal information of parents or guardians was also not exposed, officials said. ETS discovered the hack on September 25. A subsequent investigation found that “an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026,” according to information released by the California Department of Education. There is still no evidence that the information has been made public. Officials said they have not yet uncovered any evidence that the information was made public. But it’s also true that hackers often keep information confidential pending the outcome of a ransom demand. The official statement does not say whether such a demand has been made. One cybersecurity expert expressed concern that such a large breach could have occurred based on a compromised username and password. “A stolen login credential should not become a months-long passport to the personal records of millions of students,” said Anton Dahbura, executive director of the Information Security Institute at Johns Hopkins University. “If that’s what happened here, the critical question is why authentication safeguards, access restrictions and monitoring systems failed to detect and stop unauthorized activity.” He added: “Incidents like this expose a fundamental weakness in the way we manage student data: school systems can outsource the storage and processing of sensitive information, but they cannot outsource the consequences of a breach. When millions of student records are concentrated in a single provider, a security breach can become a statewide problem with consequences that will follow children for years.” organizational practices. “ETS maintains a comprehensive information security program that is periodically evaluated by third parties,” said Christine Betaneli. “We continually invest in safeguarding the systems and data we maintain.” Betaneli said no other “ETS clients” were affected. “We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and additional third-party review of our security practices,” Betaneli added. Damage Monitoring Affected alumni, including those who are now adults, are eligible for 24 months of free identity protection services and help restoring identity if identity theft occurs. Officials said parents and guardians may want to consider applying for a free credit freeze for their children under 16 to help prevent unauthorized accounts from being opened in their children’s names. “Be wary of unexpected emails, phone calls or text messages” related to the incident, including claims that the caller is from ETS or the state or a credit monitoring company, officials also warned. “Do not provide Social Security numbers, passwords, financial information, or other sensitive personal information in response to unsolicited requests.” Additional information and updates can be found on the CDE Educational Testing Service Incident webpage. Other notable educational hacks In May, a massive cyberattack unleashed chaos on California universities after hackers breached the company behind Canvas, one of the country’s most widely used educational technology platforms, where reading assignments are posted, tests are taken, and students chat with professors. The breach caused the company, Instructure, to temporarily take Canvas offline and disrupted classes, assignments, and final preparations for hundreds of thousands of students and teachers when the hackers threatened to reveal their personal data. A hacking group called ShinyHunters claimed responsibility for the attack. Instructure eventually announced that it had reached an agreement with “the unauthorized actor involved” to return the compromised data, but did not say who that actor was or whether it was a payment. He said he obtained evidence that copies of the data were destroyed, but acknowledged there was no way to know for sure. The most well-known cyberattack on a local school district was the cyberattack on Los Angeles Unified over Labor Day weekend in 2022. District officials took the unprecedented step of shutting down all district computer systems to limit the damage. The school opened as planned on Tuesday, but students, families and staff had to reset more than 600,000 passwords. Many said an entire week of instruction was lost and that technicians found “digital tripwires” left to further infect systems. The worst damage was in the facilities division, where about half of the servers were encrypted, meaning district staff couldn’t access their own systems and records. The district upheld a ransom demand but refused to pay. At first, he minimized the damage caused by the compromised information. Superintendent Alberto Carvalho said there was “no evidence of widespread impact” and called those affected “outliers.” But a Times review of the leaked files found a psychological evaluation of a student from 2005, even though the district denied such records had been leaked. It also found employee disciplinary records, criminal history reports for a worker, contractor payroll data, tax forms and passports. And a subsequent filing by the district with the state acknowledged that more than 500 people who worked for district contractors likely had Social Security numbers and other confidential information exposed. The district also later reported that about 2,000 student evaluation records had been released, including those of 60 current students.
