Millions of students caught in California data breach
Hackers accessed and copied records linked to millions of current and former California public school students, exposing personal details including addresses, birth dates and, in some cases, disability information. The breach raises concerns about how schools and their partners protect sensitive records, and it may affect families who have since moved out of California.
The breach involved an ETS-operated file transfer site used in connection with statewide assessments. State officials say an attacker used compromised login credentials to copy files between 22 May and 18 September 2026; ETS detected suspicious activity on 25 September and took the site offline. The records did not include Social Security numbers, financial details, passwords or parents’ personal information, and ETS says it has found no evidence the data was made public.
In short
- Hackers copied millions of California student records.
- Stolen details may include addresses, birth dates and disability information.
- Former California students may be affected wherever they live.
Explained simply
California’s public schools collect information about pupils to support their education and administer statewide assessments. The records can include basic details such as a pupil’s address and date of birth, as well as information about disabilities.
Educational Testing Service (ETS), a company that works on assessments, operated the file transfer site involved. Schools and education agencies may use outside companies to handle records, so protecting pupils’ information depends on both public bodies and their partners.
The issue matters to current and former pupils and their families, including those who have moved away from California. It highlights the sensitivity of education records and the need to safeguard them when they are handled or stored by outside services.
Cybersecurity Technology World