Threat Intelligence · Privacy
Millions of California students' personal data stolen in contractor breach
A cyberattack on a California education contractor exposed sensitive data of millions of students. Names, addresses, and more were taken, affecting nearly all public school students from the past three years.
Ross Grant3 min read
The short version
A hacker group stole sensitive information about millions of California public school students by breaking into a contractor’s system. The stolen data includes names, addresses, and other personal details. The state is warning families and offering free identity protection. No evidence has been found that the stolen data has been published online.
By the numbers
- 5.7 millionstudents enrolled in California public schools in 2025TechRadar
- 3 yearsperiod of student data potentially affectedTechRadar
- 24 monthsfree identity protection offered to affected familiesTechRadar
What happened?
A cyberattack on Educational Testing Service (ETS), a contractor for California’s Department of Education, exposed sensitive data of students enrolled in public schools from 2023 to the present. The breach, discovered in late September 2026, included names, addresses, student IDs, and other personal details. The state is notifying affected families and offering identity protection.
What information was stolen?
Hackers copied a wide range of personal information from students enrolled in California public schools. This included names, dates of birth, home addresses, school and district names, grade levels, and unique student identifiers. The stolen data also covered sensitive details like gender, race or ethnicity, primary language, country of origin, English learner status, disability status, and eligibility for various support programmes. In some cases, assessment results and testing accommodations were also taken. Recorded Future News (opens in a new tab)
Who is affected?
The breach affects current and former students enrolled in California public schools from 2023 to the present. It may also include students who left a California school since 2006 and did not confirm a transfer. California public schools enrolled more than 5.7 million students in the 2025 school year alone. The Department of Education believes the number of affected students could be much higher, possibly up to 17 million if all three years are included. TechRadar (opens in a new tab)
How did the breach happen?
The attack targeted Educational Testing Service (ETS), a nonprofit contractor that manages statewide student assessments. Hackers accessed and copied files from a secure file transfer site between 22 May and 18 September 2026. ETS discovered the breach on 25 September. The company disabled the compromised account and later took the site offline, rebuilding the platform to prevent further access. While the exact method is not confirmed, reports suggest attackers may have used stolen login credentials rather than exploiting a software flaw. TechRadar (opens in a new tab)
What have ETS and the state done?
ETS and the California Department of Education began notifying affected families on 16 October and will continue through November. ETS has paused some testing activities while investigating the breach and is working with law enforcement and cybersecurity experts. The company says it has not found evidence that the stolen data has been published online. ETS is offering 24 months of free identity protection to those affected. The Department of Education is reviewing ETS’s security practices and compliance with data protection rules. Recorded Future News (opens in a new tab)
What should families do?
Anyone who receives a notification should consider enrolling in the offered identity protection service. Parents and students should watch for signs of identity theft, such as unexpected credit activity or suspicious communications. Since the breach included addresses and other personal details, families should be alert to scams that use this information to appear more convincing. The Department of Education is working to minimise disruption to student testing and to strengthen security for future assessments.
The bigger picture
This is not the first time educational service providers have been targeted by cybercriminals. Other companies in the sector, such as PowerSchool and Illuminate Education, have faced similar incidents in recent years. The breach highlights the risks involved when large amounts of sensitive data are managed by third-party contractors. It also raises questions about how schools and their partners protect student information and respond to cyberattacks.
Claimed vs confirmed
- Unconfirmed
Attackers used compromised credentials to access the data.
TechRadar reports this is believed to be the method, but it is not officially confirmed.
- Confirmed
No evidence the stolen data has been published online.
ETS and the Department of Education say they have not found the data online.
Why it matters
This breach affects millions of students and their families, putting them at risk of identity theft and fraud. It also raises concerns about how schools and their contractors protect sensitive student information. The incident may disrupt student testing and lead to increased scrutiny of data security in education.
How does it work?
Attackers are believed to have accessed the data using compromised login credentials for a secure file transfer site, rather than exploiting a software vulnerability. The exact method has not been confirmed.
Key points
- Sensitive data of millions of California students was stolen from a contractor.
- The breach included names, addresses, student IDs, and more.
- Attackers likely used stolen credentials to access a secure file transfer site.
- ETS and the state are notifying families and offering identity protection.
- No evidence yet that the stolen data has been published online.
Sources
Recorded Future News
Reference
TechRadar
Reference
