Hacker Copied Records of Millions of California Students From Testing Contractor ETS, State Says

A hacker spent nearly four months inside a testing contractor's file-transfer site and copied records on millions of California public school students, the California Department of Education (CDE) announced Friday, Oct. 16.

The contractor is Educational Testing Service (ETS), the Princeton, New Jersey-based nonprofit that runs California's statewide assessments. The state says the intruder got in with one compromised login credential.

What was taken

The CDE said the hacker accessed data on "all students enrolled in the three previous school years." More than 5.7 million students were enrolled in California in 2025-26. The affected pool is larger than that, because some former students who left the state without confirming a transfer are covered by records going back to 2006.

The New York Post put the number of affected students near 7 million. The state has not published a final count.

The stolen files include names, home addresses, dates of birth, grade levels, schools and districts, and unique student identifier numbers. They also include gender, race or ethnicity, primary language, country of origin and English learner status. The files also include disability information and eligibility for federal programs, such as those for low-income students.

The state says the files did NOT contain Social Security numbers, driver's license or passport numbers, financial account or card data, or passwords. Parent and guardian information was not exposed, according to the CDE.

The timeline

Per the CDE, an unauthorized party used the credential to reach the site and copy files "at various times between May 22 and September 18, 2026." ETS identified unauthorized activity on Sept. 25. It disabled the account, took the site offline and brought in outside cybersecurity experts.

On Oct. 2, ETS told county and district officials it had stopped "normal enrollment data processing." Certain testing activities were paused while its systems were assessed.

The first public notice came Oct. 16, three weeks after discovery. ETS began notifying students and families that day and expects notifications to continue through early November. It is offering two years of identity protection through Experian IdentityWorks.

Open questions

The CDE says there is no evidence so far that the data has been made public. Stolen data is often held back while a hacker negotiates. The department's release did not say whether a ransom demand has been made, and no group has claimed responsibility in any of the state's statements.

ETS has not said whether the compromised account was protected by multi-factor authentication. It also has not said how a single credential could provide access across a roughly four-month window without detection.

Cybersecurity expert Anton Dahbura raised the same issue. "A stolen login credential should not become a months-long passport to millions of students' personal records," he said.

ETS says it has made changes. "We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices," the company said in a statement to Reuters. It added: "Our priority remains the students, families and educators we serve and safeguarding the assessment programs we deliver for our clients and partners globally."

The lack of Social Security and financial data matters. Without those fields, the immediate risk of direct financial fraud is lower. The exposed fields are still sensitive, particularly for minors. Disability status, home addresses and birth dates are the kind of detail that can be used for targeted phishing or impersonation, and a child's identity record can sit unmonitored for years.

Who is responsible for what

The state did not collect this data and then lose it from its own servers. It handed it to a contractor, which exchanged it with the CDE through a file-transfer site. The state's own letter, from Deputy Superintendent Mary Nicely, says California is "urgently working with a team of state agencies to investigate and determine scope and impact of the incident, including what information may have been affected."

The CDE says it is working to minimize disruption and resume affected assessment activities "in a timely manner." No date for resuming normal enrollment data processing has been given.

The next concrete milestone is the notification rollout through early November. That will show how many students and former students received letters. It may also settle the count the state has not yet published.