Hacker Copied Data on Millions of California Students From Testing Contractor

SACRAMENTO, California. The California Department of Education said on Friday that a hacker copied personal information on millions of public school students from a system run by Educational Testing Service, the nonprofit contractor that handles state testing for California.

The department said the intruder reached files for all students enrolled in the three previous school years. More than 5.7 million students were enrolled in California public schools in 2025-26 alone, and some former students are affected too, with records reaching back to 2006 for pupils who left without a confirmed transfer. Neither the department nor ETS has published an exact count.

What was taken

The state notice said the copied files vary by student. They can include a child's name, home address, date of birth, school, district and grade level, along with state and local student ID numbers. The files can also hold gender, race or ethnicity, primary language, country of origin and English learner status. Records on disability and Section 504 status, testing accommodations, and eligibility for federal help such as Title I and McKinney-Vento programs were also in the system, as were test registration, participation and results, and English proficiency records.

Officials said the files did not include Social Security numbers, driver license or passport numbers, bank or card details, account passwords, or personal information about parents and guardians.

A stolen login, used for months

ETS runs California's statewide assessments, including the Smarter Balanced tests and the English Language Proficiency Assessments for California. The breach hit a secure file transfer site the company and the state use to exchange student assessment data.

ETS found unauthorized activity on September 25 and opened an investigation with outside cybersecurity experts, the state notice said. The investigation found that someone using a compromised login copied files at various times between May 22 and September 18, 2026. ETS disabled the account, took the site offline and later built a replacement with stronger controls. The company said it is working with law enforcement and has found no sign the copied information has been made public so far.

District leaders first heard about the incident in a state letter dated October 2, which also said normal enrollment data processing had stopped. The public notice came on October 16, and ETS began writing to affected students and families the same day. Notifications are expected to run into early November.

Why one login matters

The case has drawn sharp questions about how one stolen password could open files on millions of children for months, unspotted. Anton Dahbura of the Johns Hopkins University Information Security Institute told reporters that a stolen login should never work as a months long pass to student records, and asked why added checks, access limits and monitoring did not stop the copying sooner.

ETS defended its practices in a statement and said it has added security steps since the discovery. The state education department said it is working with other state agencies to pin down the full scope of the incident and to get affected families clear information and support.

For now, officials tell families to stay alert for suspicious calls, texts and emails claiming to come from ETS or state agencies, and to use the help channels in the notice letters. Families can also ask the credit bureaus about a credit freeze for a child under 16, which blocks new accounts in the child's name.