Check for breach notices if you are a California public school student
Millions of California students have had sensitive education data stolen by hackers who used compromised credentials to access an ETS file transfer system.
Key points
- Attackers accessed an ETS system between May 22 and September 18 using stolen login details.
- Data includes disability info, program participation and test scores for millions of students.
- Social Security numbers, passwords and financial data were not involved in the theft.
Millions of current and former California public school students are facing a data breach involving their sensitive educational records. The California Department of Education has notified families after an unauthorized party accessed a secure file transfer site operated by Educational Testing Service. This nonprofit organisation manages the state’s standardized tests under contract with the education department.
What data was stolen and who is affected?
The breach involves personal information belonging to students enrolled in California public schools during the previous three school years. The affected population is not strictly limited to that group, but the department identifies this timeframe as the primary scope. According to Malwarebytes Labs, the state had over 5.7 million students enrolled in the 2025–2026 academic year alone.
The stolen files contain varying categories of data depending on the individual student. This includes disability and program participation information, as well as statewide assessment information including test scores. Not every affected student had every category of information exposed, but the data is more sensitive than simple contact details.
How did the attackers gain access?
An investigation determined that the unauthorized party used compromised login credentials to access the Educational Testing Service system. The attackers were able to enter the secure file transfer protocol site and copy files containing student information at various times between 22 May and 18 September.
According to TechRadar, the breach likely resulted from a simple password compromise rather than a complex software vulnerability. The attackers regained entry repeatedly over the course of four months. The specific intricacies of how the credentials were initially stolen have not been shared publicly by the organisation or the education department.
Is the data now public or sold?
Educational Testing Service states that it has found no evidence so far that the stolen information has been made public. There is also no indication that a ransom threat was made in connection with the incident. The California Department of Education is distributing breach notices to help affected individuals receive information about the incident and available resources.
ETS is working with the department to notify impacted individuals directly. The organisation has begun notifying students and families after the unauthorized access was confirmed. The California Department of Education is assisting in the distribution of these notices to ensure affected parties receive information about the incident and available resources.
What is not included in the breach?
The California Department of Education confirms that certain highly sensitive data types were not involved in this incident. Social Security numbers, financial account information, passwords and parent or guardian information were not accessed or copied by the attackers. This distinction is important for affected families assessing their risk of identity theft or financial fraud.
While the stolen files reveal personal education history and disability status, the absence of financial data and passwords reduces the immediate risk of account takeover. However, the combination of personal details can still be used for targeted phishing or social engineering attacks if the data is leaked elsewhere.
What affected people can do
Affected individuals should verify any communication about this incident through official channels provided by the school district or the department. Consider enrolling in the offered identity-protection services, ensuring parents enrol minors while adults enrol themselves. Watch for messages that use details about your child or their school to sound convincing. Do not share passwords, security codes or payment details in response to unsolicited messages or calls.
Background: Unauthorized access
The difference between authorized and unauthorized access lies in explicit permission. Authorized access occurs when a system grants entry based on verified identity and defined scope. Unauthorized access happens when an entity enters or acts without this consent, whether through stolen credentials or by exceeding their granted privileges.
Read the full guide: Difference Between Authorized and Unauthorized Access: The Hidden Boundaries
What to do and how to stay safe: Educational Testing Service
- Check your official school or district portal for a specific notification regarding this breach.
- Monitor your credit reports for unexpected inquiries, as personal details were exposed.
- Be wary of phishing emails claiming to offer help with this breach; they often request login details.
- Update passwords for any accounts that may have reused credentials linked to school systems.
Step-by-step guide: Stop Credential Leaks: A Practical Prevention Checklist
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the hackers steal Social Security numbers?
No, the California Department of Education confirmed that Social Security numbers were not involved in the breach.
How many students might be affected?
The breach includes students enrolled during the previous three school years, potentially impacting millions.
Was a software vulnerability exploited?
No, investigators found that attackers used compromised login credentials to access the system.
