Hackers Copied Records on 7 Million California Students From a Testing Contractor

Hackers Copied Records on 7 Million California Students From a Testing Contractor

Seven million records across three school years

California education officials said Friday that a hacker stole the personal data of students enrolled in the state's public schools over the past three school years — roughly 7 million records, according to the California Department of Education, a figure carried by the Los Angeles Times, Politico, Reuters, the Associated Press and others. Reuters reported that more than 5.7 million students were enrolled in California in the 2025-2026 school year alone. The AP reported that the breach reaches well beyond current enrollment: it dates back to 2023, and students who left California without confirming a transfer elsewhere are affected as far back as 2006. Many of those people are adults now.

A stolen credential opened the file-transfer door

The compromised system was not the department's own, but a secure file transfer protocol site run by the Educational Testing Service, a nonprofit that administers statewide assessments for California, including the Smarter Balanced exams and English proficiency tests. Investigators concluded that "an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026." ETS did not detect the activity until Sept. 25, about a week after it ended.

The state alerted districts, then paused testing

On Oct. 2 the department wrote to county and district officials about an "incident involving ETS-operated systems." Deputy Superintendent Mary Nicely said state education officials "are urgently working with a team of state agencies to investigate and determine scope and impact of the incident." ETS took the file-transfer site offline and built a new one with enhanced security controls, and paused normal enrollment data processing and certain testing activities. The department said it is "actively working to minimize disruption and resume affected assessment activities in a timely manner."

No Social Security numbers, but plenty that is sensitive

California says it has found no evidence the data has been made public, and that Social Security numbers, financial information, passwords, driver's licenses and parent information were not copied. What was taken is still detailed: names, birth dates, addresses, schools, student identifiers, demographic information, disability status, program eligibility and assessment results. Disability status paired with a date of birth is enough to impersonate a child.

Two years of free monitoring and a phishing warning

ETS is offering 24 months of free identity-protection and identity-restoration services through Experian IdentityWorks. Parents or guardians enroll minors; adult former students can enroll themselves. Enrollment closes March 19, 2027. Officials also suggested families consider a free credit freeze for children under 16, and warned against unexpected emails, calls or texts tied to the incident — including anyone claiming to be from ETS, the state or a credit-monitoring company. "Do not provide Social Security numbers, passwords, financial information, or other sensitive personal information in response to unsolicited requests," they said.

The contractor chain is the weak link again

"A stolen login credential should not become a months-long passport to millions of students' personal records," said Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute, who said the critical question is why authentication safeguards, access restrictions and monitoring failed. It is the second major education-sector breach this year: Canvas, a learning management system used across K-12 and higher education, was hit twice in April and May by the group ShinyHunters, which eventually returned the data under a deal.

What families can do, what the state owes

For California families, the immediate steps are to watch for the official ETS and state notices, enroll in the identity-protection service as instructed, freeze their children's credit and stay alert to phishing. For state officials, the question runs deeper: after handing millions of student records to an outside contractor, how does the state verify the security it was promised — and who answers when a single credential is enough to walk off with millions of files?