A major security breach at the state's standardized testing vendor has exposed the personal and academic records of millions of California public school students. The breach occurred at Educational Testing Service (ETS), which administers state-mandated exams like the California Assessment of Student Performance and Progress. While financial records and Social Security numbers remain secure, the leaked files contain sensitive student demographic and academic data.
What Happened
The breach occurred between May 22 and September 18, 2026. An unauthorized user gained access to an ETS secure file transfer protocol (SFTP) site using compromised credentials, as detailed by the California Department of Education. ETS found the unauthorized access on September 25, 2026, according to a notice from the Irvine Unified School District.
The breach affects about 7 million students who attended California public schools over the last three school years. The compromised files contained student names, birth dates, home addresses, grade levels, and Statewide Student Identifiers (SSIDs). The leak also exposed demographic information like race, gender, and English learner status. Some files included disability and Section 504 statuses, as well as statewide test scores.
In a public update, the California Department of Education's incident page confirmed that no Social Security numbers, driver's licenses, passwords, or financial information were exposed in the breach.
The Bigger Picture
This incident is part of a growing trend where educational testing organizations and digital learning tools are targets for cyberattacks. As we previously reported, edtech vendors handle large volumes of student data, making them prime targets for hackers.
For example, the online math platform Mathspace recently disclosed a data breach that affected over 1 million students and teachers in Australia and New Zealand. In that incident, hackers exploited a vulnerability in the platform's internal database reporting tool. Although the Mathspace breach did not expose academic grades, it showed how vulnerable student information is when stored by third-party educational tools.
School testing organizations are especially vulnerable. Because organizations like ETS coordinate test registrations across entire states, a single breach can compromise millions of student profiles at once. The California Department of Education previously noted that ETS had to temporarily pause certain enrollment data processing and testing operations while evaluating system security.
What This Means for Families
This data leak poses risks for families and educators. While identity theft involving credit card sign-ups is unlikely because Social Security numbers were not stolen, the exposed information makes families targets for phishing scams.
Scammers can use details like a student's school, grade level, primary language, or test accommodations to draft convincing, personalized emails. For instance, a parent might receive an email claiming to offer tutoring services tailored to their child's specific test results or special needs, using the stolen data to appear official.
Local school districts clarified that their own networks were not compromised. For example, the Irvine Unified School District reassured families that the leak was isolated to the testing company's servers.
What You Can Do
Parents can protect their children's information with several steps:
First, sign up for identity protection. ETS is offering two years of free identity protection and credit monitoring through Experian IdentityWorks. Parents can find instructions on how to enroll in the California Department of Education guidelines.
Second, watch out for unsolicited offers. Treat any emails or phone calls offering tutoring or academic support with skepticism, especially if they mention specific test results or schools. Always verify the sender's actual email address.
Third, confirm all communications directly. If an email claims to be from a school or the state education department and asks for personal details, do not click any links. Call the school's main office using the phone number on their official website to verify the message.