California education officials announced Friday that the personal data of millions of current and former public school students have been compromised in a cybersecurity breach involving the Educational Testing Service (ETS), which administers state-mandated standardized tests such as the Smarter Balanced assessments. The breach affects not only the approximately 5.7 million students currently enrolled but also former students dating back to 2006, including those who left the state without confirming transfers to other schools.
The exposure includes sensitive information such as students’ names, addresses, disability records, grade levels, dates of birth, school and district attendance, and unique student identifier numbers. Additional demographic details, including gender, race or ethnicity, primary language, country of origin, and English learner status, were also accessed. Data on eligibility for federal assistance programs for low-income students and disability status was part of the compromised set. Officials confirmed that Social Security numbers, passport information, financial account details, and parental or guardian information were not affected.
The breach was discovered by ETS on September 25. Preliminary investigations revealed that an unauthorized party used a compromised login credential to access and copy files containing student information over a period spanning from May 22 to September 18, 2026. While there is no current evidence that the stolen data has been made public, cybersecurity experts warn that attackers sometimes withhold data release pending ransom negotiations. The California Department of Education and ETS are actively investigating the scope and impact of the incident.
Security specialists have raised concerns regarding how a single compromised credential could allow extensive and prolonged access to millions of records. Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute, emphasized the shortcomings in authentication safeguards and monitoring systems that allowed the breach to endure for months. He highlighted the risk that concentrating large volumes of sensitive student data with a single vendor may expose statewide vulnerabilities with long-lasting consequences.
ETS responded by stating that it maintains a comprehensive security program reviewed by third parties and continuously invests in protecting its systems. A spokesperson indicated that no other customers were affected and described recent actions to enhance security, including improved monitoring and access controls along with further independent evaluations.
Affected individuals, including former students now adults, are eligible for free identity-protection and identity-restoration services for two years. Officials advised parents and guardians to consider placing free credit freezes on children under 16 to prevent unauthorized account openings. They also cautioned against responding to unsolicited communications claiming to be from ETS or the state and urged vigilance to avoid phishing scams.
This breach follows several recent cyber incidents within California’s education sector. Earlier in 2026, a cyberattack on Instructure, the company behind the Canvas learning platform, disrupted classes for hundreds of thousands of students and staff statewide. In 2022, the Los Angeles Unified School District experienced a ransomware attack that forced a complete system shutdown, exposing personal and employee data and disrupting instruction.
California education authorities have committed to ongoing investigations and security improvements aimed at safeguarding student information amid rising cybersecurity threats to the education system. Further details and updates are available on the California Department of Education’s dedicated ETS incident webpage.