Hackers copy data on millions of California students from testing contractor ETS

TLDR

• California's education department said on 16 October that an unauthorised party copied student data from an ETS file-transfer site.¹²
• Politico, citing the department, puts the affected students at 7 million, covering three school years.²⁴
• A compromised login credential gave access between 22 May and 18 September, and ETS spotted it on 25 September.¹

The California Department of Education (CDE) notice says Educational Testing Service (ETS), the nonprofit that supports California's CAASPP and ELPAC assessment programmes, found unauthorised activity on a secure file transfer (SFTP) site used to exchange statewide assessment data with the CDE. It disabled the account involved, took the site offline, built a new SFTP site with stronger controls and brought in external cybersecurity experts.¹ The investigation concluded that an unauthorised party used a compromised login credential to copy files containing student information at various times between 22 May and 18 September 2026.¹

According to the notice, the data varies by individual and may include name, date of birth, residential address, school, district, grade level, Statewide Student Identifier, gender, race or ethnicity, primary language, country of origin, English learner status, disability and Section 504 status, testing accommodations, eligibility for programmes such as Title I, McKinney-Vento and Military Connected Student, and English language proficiency and statewide assessment results.¹ It did not include Social Security, driver's licence or passport numbers, financial or card information, or account passwords, and it did not involve parent or guardian information.¹

ETS says that, after working with law enforcement and security experts, it has taken steps to reduce the risk of the data being made public, and that web monitoring has so far found no evidence that it has been.¹ The California Cybersecurity Integration Center is assisting with forensics and incident response, with the Department of Technology and the Governor's Office of Emergency Services supporting the state's response, and the CDE and State Board of Education are reviewing ETS's compliance with data security and contractual requirements.¹ ETS is providing two years of Experian IdentityWorks, which the Los Angeles Times describes as 24 months of free identity protection and restoration help.¹³ None of the sources read for this piece names a suspected attacker or reports a ransom demand.

The sources differ in how they size the incident. The CDE notice says data "including but not limited to all students enrolled in the three previous school years" was copied, without a figure in the text read.¹ Politico attributes 7 million students to the CDE, the New York Post says 7 million (headline: "nearly 7M"), and the Los Angeles Times says only "millions".²³⁴

Why it matters: a single compromised credential on a file-transfer site was enough to copy years of records on children, including disability and programme-participation data, and the notice came about three weeks after ETS identified the activity.¹