Hackers have stolen the data \u2014 including names, addresses and disability records \u2014 of millions of current and former California public school students who took the state\u2019s mandated standardized tests that annually assess their academic proficiency, education officials announced Friday. <\/p>\n
The compromised information affects many more than the state\u2019s current 5.7 million public-school students as the breach dates back to 2023 enrollments. Students who left California but did not confirm their transfer to another school also were affected, dating back to 2006.<\/p>\n
The data breach involved Educational Testing Service or ETS<\/a>, which provides extensive services to California. <\/p>\n While the first public notice was Friday, school district leaders received word on Oct. 2.<\/p>\n State education officials \u201care urgently working with a team of state agencies to investigate and determine scope and impact of the incident, including what information may have been affected,\u201d according to a letter from state Deputy Supt. Mary Nicely<\/a>.<\/p>\n ETS, a nonprofit assessment organization, helps manage and provide testing-related services for students enrolled in California public schools, including the required Smarter Balanced tests administered in spring. In this role, ETS maintains student demographic, test participation and assessment data.<\/p>\n The exposed information also includes student grade level, date of birth and the school and district students attend. The hackers also obtained access to unique student identifier numbers as well as information about gender, race or ethnicity, primary language, country of origin and English learner status. Also exposed was information about student disabilities and student eligibility status for federal programs, such as those available to help students from low-income families. <\/p>\n The stolen data did not include Social Security numbers, driver\u2019s license numbers, passport numbers, financial account information, credit or debit card information or account passwords. Nor was parent or guardian personal information exposed, officials said.<\/p>\n ETS discovered the hack on Sept. 25. A subsequent investigation found that \u201can unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026,\u201d according to information posted by the California Department of Education<\/a>. <\/p>\n No evidence yet that information made public<\/p>\n Officials said they have not yet uncovered any evidence that the information has been made public. But it\u2019s also true that hackers will often keep information confidential pending the outcome of a ransom demand.<\/p>\n The official release did not say whether such a demand has been made.<\/p>\n One cybersecurity expert expressed concern that such a vast breach could have occurred based on one compromised user name and password. <\/p>\n \u201cA stolen login credential should not become a months-long passport to millions of students\u2019 personal records,\u201d said Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute. \u201cIf that is what happened here, the critical question is why authentication safeguards, access restrictions, and monitoring systems failed to detect and stop the unauthorized activity.\u201d<\/p>\n He added: \u201cIncidents like this expose a fundamental weakness in how we manage student data: School systems may outsource the storage and processing of sensitive information, but they cannot outsource the consequences of a breach. When millions of student records are concentrated with a single vendor, one security failure can become a statewide problem with consequences that follow children for years.\u201d<\/p>\n A spokesperson for ETS defended the organization\u2019s practices.<\/p>\n \u201cETS maintains a comprehensive information security program that is regularly assessed by third parties,\u201d said Christine Betaneli. \u201cWe continuously invest in safeguarding the systems and data we maintain.\u201d<\/p>\n Betaneli said no other \u201cETS customers\u201d were affected. <\/p>\n \u201cWe have implemented additional safeguards, including enhanced monitoring, strengthened access controls and further third-party review of our security practices,\u201d Betaneli added. <\/p>\n Monitoring for damage<\/p>\n Affected former students, including those who are now adults, are eligible for 24 months of free identity-protection services and identity-restoration help if there is identity theft. <\/p>\n Officials said that parents and guardians may want to consider requesting a free credit freeze for their children who are under 16 to help prevent unauthorized accounts from being opened in the names of their children.<\/p>\n \u201cBe cautious of unexpected emails, phone calls, or text messages\u201d related to the incident, including claims that the caller is from ETS or the state or a credit monitoring company, officials also warned. <\/p>\n \u201cDo not provide Social Security numbers, passwords, financial information, or other sensitive personal information in response to unsolicited requests.\u201d<\/p>\n Additional information and updates can be found at the CDE Educational Testing Service Incident webpage<\/a>.<\/p>\n Other notable education hacks<\/p>\n In May, a massive cyberattack sparked chaos across California colleges after hackers breached the company behind Canvas, one of the nation\u2019s most widely used education technology platforms, where reading assignments are posted, tests are taken and students chat with teachers.<\/p>\n The breach caused the company, Instructure, to temporarily take Canvas offline and interrupted classes, assignments and finals preparations for hundreds of thousands of students and professors as hackers threatened to release their personal data.<\/p>\n A hacking group named ShinyHunters claimed responsibility for the attack. Instructure eventually announced it reached a deal <\/a>with \u201cthe unauthorized actor involved\u201d to return the compromised data, but didn\u2019t say who that actor was or whether payment was involved. It said it obtained proof that copies of the data were destroyed, but acknowledged there was no way to know for sure.<\/p>\n