Millions of California student records were compromised in a significant data breach, affecting current and former students, including those who have moved out of state.
A massive data breach involving the Educational Testing Service (ETS) has exposed sensitive records belonging to millions of California public school students. This incident raises serious concerns about the security of student information and who has access to it.
The breach, which occurred between May 22 and September 18, 2026, allowed hackers to gain unauthorized access to a secure file transfer site operated by ETS. The stolen data includes home addresses, birth dates, and details about disabilities, potentially affecting not only current students but also those who attended California public schools in the past.
Families who have relocated out of California may also find themselves impacted by this breach, as records dating back to 2006 are included. This means that if a child attended school in California and then moved to another state, their personal information could still be at risk.
ETS, a nonprofit organization that collaborates with the California Department of Education to administer statewide assessments, discovered the breach on September 25, 2026. Following the detection of suspicious activity, the organization disabled the compromised account and took the file transfer site offline. They have since engaged cybersecurity specialists to investigate the incident and have implemented stronger security measures.
While ETS has reported no evidence that the stolen information has been made publicly available, the breach poses a significant privacy risk. The compromised records may contain information that could help someone identify a child or learn personal details about their family circumstances. Although Social Security numbers, financial account details, and driver’s license numbers were not included in the breach, the exposure of other sensitive information raises serious concerns.
The California Department of Education has confirmed that the breach affects a wide range of individuals, including those who may have left the public school system years ago. Current estimates suggest that approximately 5.7 million students are enrolled in California public schools, and the breadth of the compromised files means that millions of people could potentially be involved.
In response to the breach, ETS began notifying affected students and families on October 16, 2026. Notifications are expected to continue through early November and will include details about the incident, the types of information involved, and instructions for accessing complimentary identity-protection services. However, it is crucial for families to understand that not receiving a notification does not necessarily mean their information is safe, as outdated contact information may prevent some individuals from being informed.
ETS is offering 24 months of free identity theft protection to affected individuals, including current and former students. Parents or legal guardians can enroll eligible children under 18, while adults can enroll themselves. The enrollment deadline is March 19, 2027. Additionally, identity restoration assistance will be available for 24 months from the notification date, even for those who do not enroll in monitoring services.
Families concerned about their information can visit the official California ETS incident webpage for further details and resources. The site contains frequently asked questions and links to breach notifications available in multiple languages. An incident assistance line is also available for inquiries.
As the investigation continues, the California Department of Education and the State Board of Education are working with cybersecurity specialists to assess ETS’s compliance with data security requirements. ETS has stated that they are enhancing monitoring, strengthening access controls, and conducting further reviews of their security practices.
Despite the absence of evidence indicating that the stolen information has been publicly leaked, the potential for misuse remains a pressing concern. Families should remain vigilant and take proactive steps to protect their personal information. This includes monitoring for unexpected communications that may appear to come from legitimate sources, such as schools or testing organizations.
Parents are encouraged to consider placing a security freeze on their child’s credit file, which can help prevent identity theft. Additionally, they should review their credit reports for any unfamiliar accounts or suspicious activity. The Federal Trade Commission provides resources for reporting identity theft and offers recovery plans for those affected.
This breach serves as a reminder of the importance of data security, particularly when it comes to sensitive information about children. As families navigate the aftermath of this incident, they deserve transparency from educational institutions regarding how long student records are retained and the measures in place to protect that data.
In light of this breach, the question arises: Should schools and testing companies retain sensitive student records for extended periods, or should families have more control over the deletion of that information? This incident highlights the need for a reevaluation of data retention policies in the education sector.
For further information and updates, families can stay informed through the California Department of Education’s official channels and by following developments related to the breach. As the situation unfolds, it is essential for affected individuals to take advantage of the resources and protections being offered.
According to CyberGuy, the implications of this breach extend beyond California, affecting families across the United States who have past ties to the state’s public school system.