Millions of current and former California public school students had their personal details stolen in a massive data breach at a state testing vendor. The breach compromises records dating back to 2006, exposing clear gaps in how student data is stored and protected. As we previously reported, this exposure shows the vulnerabilities that exist when private companies handle public education records.
What Happened
According to the California Department of Education, hackers used compromised login credentials to access and copy files from Educational Testing Service (ETS) between May 22 and September 18, 2026. While school districts were quietly notified on October 2, the public only learned of the breach weeks later. The stolen files contain demographic data for students who took mandated state assessments. This includes names, home addresses, dates of birth, grade levels, student identification numbers, and details on gender, race, country of origin, and English-learner status. Information regarding student disabilities was also accessed. Although the state’s current enrollment is 5.7 million students, the breach affects far more people because it includes historical files dating back to 2006. The state confirmed that Social Security numbers, driver’s licenses, and parent financial information were not part of the breach.
The Bigger Picture
This incident raises an obvious question: why is data from students who graduated nearly two decades ago still sitting on a vendor's servers? The answer lies in weak federal regulations and a mix of different state laws. A recent report by the Brookings Institution explains that federal laws like the Family Educational Rights and Privacy Act (FERPA) fail to mandate "data minimization," which is the practice of deleting student records once they are no longer needed. Because federal law does not regulate third-party vendors directly, protecting student records falls to individual state rules. As analyzed by Obtainer, while some states like Illinois and New York require explicit data-disposal terms in school contracts, California's Student Online Personal Information Protection Act (SOPIPA) focuses primarily on banning the sale of student data rather than forcing vendors to purge old records. This allows companies to store historical student data indefinitely, leaving a massive trail for hackers to exploit.
What This Means for Families
Even though hackers did not steal Social Security numbers, families should not assume their children are safe. According to Experian, identity thieves use basic demographic details like names, addresses, and birth dates to open fraudulent bank accounts, apply for loans, or set up utilities in a child's name. Since children do not check their credit, this fraud often goes unnoticed until they turn 18 and apply for a credit card. The Michigan Attorney General's office also warns that scammers are skilled at piecing together stolen directory data to create convincing phishing scams that target parents and older students.
What You Can Do
Parents can protect their children's information by requesting a free security freeze with the three major credit bureaus to block unauthorized accounts. Allstate Identity Protection notes that this freeze is the single most effective way to prevent child identity theft.
To stop these breaches from happening, school districts should require all EdTech vendors to secure logins using Single Sign-On (SSO) and Multi-Factor Authentication (MFA). Research from Talentus Global shows that third-party integrations account for 40% of educational cyber breaches, meaning central MFA systems are essential.
Finally, school boards need to update district contracts to include strict data retention timelines. According to Wrightmann Law, agreements should require written breach notifications within 72 hours and a legally binding certificate of deletion to force vendors to destroy student records once a contract ends.