According to the California Department of Education, on October 16th, hackers exploited a system vulnerability in a non-profit state government contracting agency to access the data of millions of students. This data includes student names, birthdates, addresses, and disability statuses.
The Educational Testing Service (ETS) began notifying students and their families of the breach on the 16th. Unauthorized third parties used stolen login information to copy records from a secure file transfer site between May 22nd and September 18th.
For the 2025-2026 school year, over 5.7 million students were enrolled in California. The Department of Education expressed deep regret in a statement, stating that “ETS places a high value on the security of student information.”
The Department of Education is sending out notifications of the data breach by ETS to provide details to parents and offer assistance. Upon learning of the incident, the Department of Education, along with the State Board of Education, immediately collaborated with the state government’s cybersecurity agency and ETS to assess the situation and prepare relevant notifications.
On September 25th, ETS discovered unauthorized activity on a secure file transfer site used to send student assessment data to the state government. ETS promptly deactivated associated accounts, shut down the site, and engaged external cybersecurity experts for assistance with the investigation.
Investigators found that someone had used stolen login information to access the site and copy files multiple times between May 22nd and September 18th. These files included data on students enrolled in the past three school years, potentially including school enrolment, grade levels, statewide student IDs, demographic information, disability statuses, program participation, and assessment records. Fortunately, sensitive information like social security numbers, financial account details, passwords, or parental information was not compromised.
The notification has been published on the California Department of Education website in 27 languages, providing details about the incident and information on identity protection services available.
The California Department of Education and the State Board of Education are reviewing the incident and assessing whether ETS complied with applicable cybersecurity regulations and contract requirements.
ETS has shut down the old website and established a new site with enhanced security measures. Ongoing monitoring has not uncovered evidence that related data has been publicly disclosed.
The California school system has experienced data breaches in the past. In September 2022, the Los Angeles Unified School District was targeted in a cyberattack, resulting in hackers gaining access to approximately 2,000 records containing sensitive student information.
A ransomware criminal group stole some records from the district and threatened to release the information unless a ransom was paid. The then-district superintendent, Alberto Carvalho, refused to pay the ransom, and the group subsequently published the data online.
On February 22nd of this year, officials from the Long Beach Unified School District informed parents via email that student data from the district’s records system had been stolen and published online.
The email stated that the compromised information included student identification numbers, names, and email addresses but did not involve sensitive information such as addresses, social security numbers, birthdates, or grades.