California Student Data Breach Exposes Millions via ETS Contractor: Names, Addresses, Disabilities at Risk

A significant data security incident has compromised personal information belonging to millions of current and former California public school students through a breach at Educational Testing Service (ETS), a nonprofit contractor handling statewide assessments for the California Department of Education (CDE). Official notifications began on October 16, 2026, with the CDE confirming that an unauthorized party used a compromised login credential to access and copy files from an ETS secure file transfer protocol (SFTP) site between May 22 and September 18, 2026. The breach was discovered on September 25, after which ETS disabled the account, took the site offline, engaged external experts, and later rebuilt the system with enhanced controls.

The exposed data includes student names, dates of birth, addresses, schools, grade levels, Statewide Student Identifiers (SSID), demographic details (such as race/ethnicity, gender, primary language, and English learner status), disability and program participation information (including Section 504 status and testing accommodations), and assessment records. Notably absent are Social Security numbers, financial details, passwords, and parent/guardian information. The scope covers students enrolled in the three previous school years—more than 5.7 million in 2025-2026 alone—plus certain former students dating back potentially to 2006 in cases of unconfirmed transfers.

ETS is offering affected individuals two years of free identity-protection services through Experian IdentityWorks. The CDE has distributed breach notices in 27 languages and is reviewing ETS's compliance with security and contractual obligations. No evidence has emerged of the data being posted publicly, per ongoing monitoring.

This incident underscores systemic vulnerabilities in education data handling, particularly reliance on third-party contractors for sensitive statewide testing programs like CAASPP and ELPAC. It echoes prior California school breaches, such as the 2022 Los Angeles Unified School District ransomware attack exposing around 2,000 records and a Long Beach Unified incident involving student IDs and emails. The single compromised credential here highlights credential hygiene failures and the risks of centralized data repositories containing detailed profiles—including disability status—that could enable targeted exploitation, discrimination, or identity-related fraud even without SSNs. Broader implications include eroded trust in educational institutions' data stewardship and calls for stricter oversight of contractors managing student records.