A hacker slipped into the secure file-transfer system used to run California's statewide student testing and sat there undetected for roughly four months, copying personal records on millions of public school students before anyone noticed. The intrusion, which ran from May 22 to September 18, exposed names, birth dates, home addresses, disability status and other sensitive details tied to current and former students across the state.
The breach originated inside Educational Testing Service, the New Jersey-based nonprofit contractor that administers California's statewide assessments, including the California Assessment of Student Performance and Progress and English language proficiency exams, according to KELO. An unauthorized party used a compromised login credential to get into ETS's secure file-transfer site and copy student information files, the California Department of Education said in its breach notice. As Cybernews reported, the state education department announced the breach as affecting millions of current and former students.
The scale of what was exposed is staggering for a single contractor's systems. Personal information tied to all 7 million students enrolled in California public schools over the past three school years was exposed, according to Politico, which reported that the unauthorized party copied the files between May 22 and September 18. ETS did not discover the incursion until September 25, days after the access had already ended, the outlet reported.
What Was Taken — and What Wasn't
The exposed records reach well beyond basic contact information. According to the Los Angeles Times, the data included student grade levels, dates of birth, and the schools and districts students attend, along with unique student identifier numbers, gender, race or ethnicity, primary language, country of origin and English learner status. The breach also swept in disability status, testing accommodations and primary disability type, as well as Section 504 status and eligibility for certain federal programs, per the state's breach notice. Some of the affected records date back to 2023 enrollments, the Times reported, while the state's notice says the files also touched some former students who left California without confirming a transfer, stretching back to 2006.```
Despite the breadth of the exposure, officials say several of the most dangerous categories of data were untouched. The stolen data did not include Social Security numbers, driver's license numbers, passport numbers, financial account information, credit or debit card information or account passwords, the same report notes. Officials said they have not yet uncovered any evidence that the information has been made public.
Notifications Rolling Out Through Early November
ETS began notifying affected students and families of the breach Friday, according to the Los Angeles Times account, with the state's notice indicating that notifications are expected to continue through early November. ETS sent a letter to county and district school officials on October 2 ahead of the broader notification effort, and the state education department is offering affected current and former students two years of free identity-protection services through Experian IdentityWorks.
In a statement to Reuters cited in ETS's security update, the organization said it has implemented additional safeguards, including enhanced monitoring, strengthened access controls and further third-party review. ETS also said it took the compromised file-transfer site offline and built a new one with enhanced security controls. The California Department of Education's October 2 letter said normal enrollment data processing had stopped. The organization said its priority is students, families, educators and safeguarding assessment programs, and that it is working to minimize disruption to assessment activities.
Part of a Troubling Pattern for School Data
California's public school system spans more than 1,000 districts and enrolled more than 5.7 million students in the 2025-2026 school year, giving a sense of how much of the state's student population could be touched by records reaching back three school years. The breach also lands amid a broader pattern of attacks on education-sector data systems; the sector has been reported to have the highest ransomware attack rate of any industry, according to TechTarget.
The ETS incident echoes an earlier breach at PowerSchool, a separate student-data platform used by districts nationwide. PowerSchool disclosed in late 2024 that attackers had compromised a credential to access its PowerSource customer support portal, with the earliest evidence of unauthorized activity dating to December 19, 2024, and the breach discovered on December 28. Court documents later said that breach compromised the personal information of approximately 62 million individuals, including Social Security numbers and medical records, and federal prosecutors attributed the attack to a 19-year-old identified as Matthew D. Lane. Whether the ETS intrusion will lead to a similar accounting of responsibility remains to be seen.
