Hacker Accessed Data on Millions of California Students, State Education Department Says

The California Department of Education said Friday that a hacker accessed the data of millions of students by exploiting the system of a nonprofit contractor that works with the state. The data included students’ names, birth dates, addresses, and disability status.

Educational Testing Service (ETS) began notifying students and families on Oct. 16 of the breach, which involved an unauthorized party using a compromised login to copy records from a secure file transfer site between May 22 and Sept. 18.

More than 5.7 million students were enrolled in California during the 2025–2026 school year.

“ETS takes the security of student information with the utmost seriousness, and sincerely regrets that this incident occurred,” the department said in a statement.

The department is sending out ETS’s Notice of Data Breach so families get details on the incident and available help. After learning of the breach, the department and the State Board of Education worked with state cybersecurity partners and ETS to assess what happened and prepare the notices.

ETS discovered unauthorized activity on Sept. 25 on a secure file-transfer site used to share California assessment data with the state. It disabled the account, took the site offline, and brought in outside cybersecurity experts.

Investigators found that someone used a compromised login to access the site and copy files at various times between May 22 and Sept. 18. The files covered California students, including those enrolled in the three previous school years.  

Information that may have been copied includes student names, dates of birth, addresses, schools, grade levels, Statewide Student Identifiers, demographic details, disability and program participation status, and assessment records.

Social Security numbers, financial account information, passwords, and parent or guardian details were not involved.

The notice of data breach is available online in 27 languages on the California Department of Education website and provides additional details about the incident and the identity-protection services.

The department and the State Board of Education are reviewing the incident and ETS’s compliance with applicable data security and contractual requirements.

ETS has taken the old site offline and built a new one with stronger security controls. Regular monitoring has not found evidence that the information has been posted publicly.

California school systems have previously had data breaches. The cyberattack that hit the Los Angeles Unified School District in September 2022 involved hackers accessing about 2,000 sensitive student records.

A ransomware group stole a portion of the district’s records and threatened to publish the information unless a ransom was paid. When superintendent Alberto Carvalho refused, the group published the data online weeks later. 

Student data was stolen from the Long Beach Unified School District’s records system and posted online, district officials said in an email to parents Feb. 22.

Information including student identification numbers, names, and email addresses was compromised, the district said in the email.

However, it noted that sensitive student and staff information, such as addresses, Social Security numbers, birthdates, and grades, was not compromised in the leak.

Micaela Ricaforte contributed to this report.