A major security breach at California's primary standardized testing contractor has exposed the sensitive information of millions of public school students. Hackers spent nearly five months accessing records containing personal details, test scores, and disability statuses before being detected. The incident shows the vulnerability of school districts that rely on third-party digital vendors to manage student data.
What Happened
According to the California Department of Education notification, an unauthorized party used a compromised login credential to access a secure file transfer protocol (SFTP) site managed by the Educational Testing Service (ETS). The unauthorized access went unnoticed between May 22 and September 18, 2026, which allowed hackers to copy files for months. As reported by the Los Angeles Times, the breach impacts students enrolled in California public schools over the last three years, as well as some historical data dating back to 2006.
The compromised files contained specific student details. According to the official CDE incident notice, exposed data includes student names, dates of birth, home addresses, school districts, and Statewide Student Identifiers (SSIDs). The files also contained student demographics, primary languages, English proficiency levels, and state assessment scores. For families of students with special needs, the breach exposed documented disability statuses, Section 504 statuses, primary disability types, and testing accommodations.
Both state officials and ETS security reviews confirmed that Social Security numbers, financial details, passwords, and parent or guardian names were not part of the compromised datasets.
The Bigger Picture
This breach highlights a major concern in modern education: the amount of sensitive student data managed by external partners. As we previously reported, teaching students and schools about digital safety is a primary defense. While technology is integrated into classrooms to support instruction and Individualized Education Programs (IEPs), it also introduces privacy risks.
According to a parent factsheet from the National Clearinghouse on Rehabilitation Training Materials, families have clear legal rights under the Individuals with Disabilities Education Act (IDEA) regarding how their children's educational data is managed. When sensitive special education records are compromised, the consequences extend beyond typical identity theft. An academic study on inclusive classroom technology warns that exposing students' disability status and behavioral records can lead to discrimination and stigmatization. It can also cause breaches of what researchers call "mental privacy."
What This Means for Families
Even though Social Security numbers were not stolen, families should not assume their children are safe from fraud. Cybercriminals frequently use minor personal details, such as home addresses, birthdays, and school names, to orchestrate targeted scams. According to PNC Insights, young people are prime targets for identity theft because they rarely monitor their credit histories. This allows fraudsters to open accounts undetected for years.
Scammers also use this stolen information to conduct "social engineering" attacks. As described by Merrill Lynch financial experts, criminals build trust by quoting real details, like a child's school district or state assessment history, to impersonate school officials or financial aid officers. This tactic is dangerous for older students who may soon apply for college aid, where providing sensitive information like Social Security numbers is a standard requirement to receive federal student aid.
What You Can Do
Parents can protect their children by taking several steps. Because the breach exposed names and birthdates, parents should check if their child has an active credit file and consider placing a security freeze on their child's credit with the major bureaus. This prevents unauthorized account creation. Affected families can also enroll in two years of free identity protection services offered by ETS through Experian IdentityWorks. Finally, parents should talk to their children about phishing. They should remind them never to share personal information over phone or email, as legitimate schools and banks do not demand immediate payment or credential verification.