A data breach at a state testing contractor has exposed the personal information of approximately 7 million California public school students. The incident compromised records from the past three academic years and raised concerns about how third-party vendors handle student data.
What Happened
According to the California Department of Education, hackers compromised the systems of Educational Testing Service (ETS), a non-profit testing organization that administers the state's standardized academic assessments. The unauthorized access occurred over a four-month period between May 22 and September 18, 2026, using stolen credentials to repeatedly copy student files. The breach was discovered on September 25, 2026, and the state began notifying families on October 16, 2026.
The compromised files include student names, physical addresses, dates of birth, demographics, student IDs, and disability status. State officials confirmed that highly sensitive government identifiers, such as Social Security numbers, driver's licenses, and financial account information, were not exposed. While most reports focus on students from the past three school years, some records date back to 2006. As we previously reported, the breach has disrupted local districts as they audit their current systems.
The Bigger Picture
This incident shows a growing vulnerability in school districts nationwide: their reliance on third-party technology vendors. Under the Family Educational Rights and Privacy Act (FERPA), schools are legally responsible for ensuring vendors maintain strict data security. If a vendor improperly rediscloses or fails to protect student records, federal rules state the institution can be barred from working with that vendor for at least five years.
However, monitoring and enforcement remain difficult. A recent state-level audit in Utah revealed that more than half of analyzed school apps collected unauthorized student data, showing a systemic failure to audit third-party security practices. When school systems rely on external corporations to handle testing databases, student privacy depends entirely on the vendor's security.
What This Means for Families
Even without Social Security numbers, the exposure of physical addresses, birth dates, and disability status poses risks. Criminals can use this information to run targeted phishing scams or attempt child identity theft. This fraud occurs when someone opens financial accounts or lines of credit using a minor's identity. Because children do not use credit, this fraud often goes unnoticed until they turn 18 and apply for student loans or credit cards.
What You Can Do
Parents can take several steps to protect their children's financial security. First, you can request a free credit freeze for children under the age of 16 with the three major credit bureaus. This security freeze prevents credit bureaus from releasing reports, which stops people from opening accounts in your child's name.
You should also watch for warning signs of identity theft. Be alert if your child receives unsolicited pre-approved credit cards, bills, or debt collection letters in their name. These letters are often the first sign that personal info has been compromised.
Finally, parents can sign up for the free monitoring service. ETS is offering two years of free identity theft protection services to affected students. Check your mail or email for enrollment instructions.