Millions of students caught in California data breach

Hackers accessed and copied records linked to millions of current and former California public school students, exposing personal details including addresses, birth dates and, in some cases, disability information. The breach raises concerns about how schools and their partners protect sensitive records, and it may affect families who have since moved out of California.

The breach involved an ETS-operated file transfer site used in connection with statewide assessments. State officials say an attacker used compromised login credentials to copy files between 22 May and 18 September 2026; ETS detected suspicious activity on 25 September and took the site offline. The records did not include Social Security numbers, financial details, passwords or parents’ personal information, and ETS says it has found no evidence the data was made public.