Millions of California Students Affected by Massive Data Breach

Millions of current and former California public school students may have had sensitive personal information stolen in a data breach affecting Educational Testing Service (ETS), a contractor for the California Department of Education.

The breach, discovered on September 25, 2026, involved unauthorized access to an ETS-operated secure file transfer site. Investigators determined that an attacker used a compromised login credential to gain access between May 22 and September 18, 2026, copying files containing student information. ETS has since disabled the compromised account, taken the affected site offline, and implemented stronger security controls in a replacement system.

Sensitive records potentially stolen include student names, birth dates, home addresses, school names, grade levels, statewide and local student identification numbers, race, ethnicity, primary language, country of origin, English learner status, disability information, testing accommodations, participation in educational assistance programs, and statewide assessment participation and test results. Notably, Social Security numbers, financial account details, driver's license numbers, passwords, and parent or guardian personal information were not reported as compromised.

The breach's scope extends beyond current California students. The compromised files may include records of former students who left California public schools as far back as 2006, provided their transfers to another school were not confirmed with the department. This means individuals who previously attended California public schools, even if they now live in other states, could be affected.

ETS began notifying affected students and families on October 16, 2026, with notifications expected to continue through early November. These notifications will detail the incident, the types of information involved, and provide instructions for accessing complimentary identity-protection services. Families who are concerned can visit the official California ETS incident webpage for more information and assistance lines.

Educational Testing Service is offering affected current and former students 24 months of free identity theft protection and restoration assistance. Enrollment for these services is free and requires activation through a provided code, with a deadline of March 19, 2027. The California Department of Education has a dedicated webpage with details and FAQs about the incident.

Experts advise families to verify breach notifications directly through official websites, consider the offered identity protection services, and potentially place security freezes on children's credit files. Additionally, vigilance regarding suspicious school-related communications and reviewing credit reports for any signs of identity theft are recommended. Families are also encouraged to inquire about school districts' data retention policies and security safeguards.