A massive data breach has exposed the personal information of millions of California public school students who took state tests over the last three years. The breach occurred at Educational Testing Service (ETS), a nonprofit organization contracted to run statewide assessments. As we previously reported, this exposure shows that student data stored by third-party contractors is increasingly vulnerable.
What Happened
According to the California Department of Education notification, an unauthorized intruder used stolen login credentials to access an ETS secure file transfer site. The hack went undetected for months, occurring between May 22, 2026, and September 18, 2026.
As detailed by the Los Angeles Times, the compromised files contained detailed student profiles. These files included student names, birthdates, home addresses, testing accommodations, primary languages spoken, and academic test scores. The hack also exposed demographics such as race, gender, and special program enrollments, including homeless status and disability categories. A Reuters report confirmed that the breach did not expose Social Security numbers or financial information. However, the volume of data is large, affecting anyone enrolled in a California public school over the past three school years. During the 2025-2026 school year alone, the state had more than 5.7 million students enrolled.
The Bigger Picture
Schools increasingly rely on outside vendors for classroom tools and administrative management, creating vulnerabilities. According to an EdTech Magazine roundtable, external vendors are involved in roughly 48% of all educational data breaches. School districts find it difficult to vet the software layers that their contractors use, creating what cybersecurity experts call a "chain of exposure."
Other school services have faced similar issues. Recently, school administrative software provider Frontline Education suffered a breach that exposed sensitive employee files, as reported by Security Magazine analysis. The Office of the Privacy Commissioner also investigated a hack on the Canvas learning management system that led to student data theft and web defacement.
In a Northeastern University interview, experts pointed out that hackers target K-12 school systems because these districts are historically underfunded for cybersecurity. When large companies like PowerSchool or ETS are hacked, criminals gain access to central databases containing millions of clean, unmonitored student identities.
What This Means for Families
Adults usually find out quickly when their information is stolen because of credit monitoring alerts. Children do not have active credit profiles. According to a Greenlight guide, this makes data belonging to minors valuable on the dark web. Fraud rings take a child's clean, unused Social Security number and combine it with a fake name and birthdate to create a "synthetic identity."
Because children do not apply for credit cards or car loans, this synthetic fraud can go undetected for over a decade. Parents often only discover the damage when their teenager applies for a first student loan or mobile phone plan and finds their credit score ruined by fraudulent debt.
What You Can Do
Parents can take several steps to protect their children's information. First, they can freeze their child's credit. According to a CBS Philadelphia alert, placing a credit freeze with the three major credit bureaus is the most effective way to prevent unauthorized accounts from being opened in a child's name.
Parents should also watch for warning signs. These include credit card offers mailed directly to the child, collection calls, or sudden denials of government benefits. The Greenlight guide identifies these as primary red flags.
Finally, families affected by the California incident can set up free protection. ETS is offering two years of free credit monitoring and identity restoration services through Experian IdentityWorks, according to the California Department of Education notification.