Millions of California Students' Sensitive Data Stolen in Breach
Millions of California Students’ Sensitive Data Stolen in Breach
🚨 Breaking News: Personal information belonging to millions of current and former California public school students has been stolen from a system operated by Educational Testing Service (ETS). ETS is a nonprofit organization that helps run the state’s standardized tests under contract with the California Department of Education (CDE).
ETS has begun notifying students and families after an unauthorized party accessed and copied student information from an ETS-operated secure file transfer protocol (SFTP) site. An investigation determined that an unauthorized party used compromised login details to access the site and copy files containing California student information at various times between May 22 and September 18.
The CDE says the breach includes all students enrolled during the previous three school years, although the affected population is not limited to that group.
What Information Was Stolen?
The information involved varies by individual but may include:
- Student names
- Statewide Student Identifiers (SSIDs)
- Dates of birth
- Home addresses
- Demographic information
- Disability and program participation information
- Statewide assessment information, including test scores
According to the CDE, over 5.7 million students were enrolled in California public schools during the 2025-2026 school year alone. Not every affected student had every category of information exposed. However, this is clearly more than a list of names and email addresses: The stolen files can reveal highly personal information about a student’s education and disabilities.
CDE says Social Security numbers, financial account information, passwords, and parent or guardian information were not involved. ETS says it has found no evidence so far that the stolen information has been made public.
What Should You Do?
ETS, at CDE’s direction, is notifying affected students and families. If your information or your child’s information was involved, follow the instructions in the notification. Individuals should verify any communication about the incident through official channels. Additionally, consider enrolling in the two years of free identity-protection services. Parents or legal guardians can enroll affected minors, while affected adults can enroll themselves. Check the instructions for the appropriate age group.
It is important to watch for messages that use details about your child or their school to sound convincing, and not to share passwords, security codes, or payment details in response to an unsolicited message or call.