Hackers accessed personal information belonging to roughly 7 million California public school students in a sweeping data breach, authorities said Friday.
The compromised records were held by a nonprofit organization contracted by the California Department of Education, according to Politico.
The exposed information includes students’ names, demographic details and disability status. The breach affected every student enrolled in California’s public schools during the past three years.
The targeted organization was Education Testing Service, or ETS, the nonprofit responsible for administering standardized tests to students in the state’s K-12 public schools.
ETS oversees California’s major statewide assessments, including the California Assessment of Student Performance and Progress, known as CAASPP, and the English Language Proficiency Assessments for California, or ELPAC.
“On September 25, 2026, ETS identified unauthorized activity involving an SFTP site used to exchange California statewide assessment information with CDE,” the California Department of Education said.
The agency said ETS deactivated the affected account, took the file-transfer site offline and launched an investigation with outside cybersecurity specialists. Investigators determined that an unauthorized individual had used a compromised login credential at various points between May 22, 2026, and September 18, 2026, to access the site and copy files containing California student data.
YOU MIGHT ALSO LIKE: Zohran Mamdani’s Week From Hell Shakes His Grip on New York’s Left
In response, ETS suspended routine enrollment-data processing and put some testing operations on hold while it evaluates the security of its systems, according to a letter issued by the California Department of Education.
ETS also said it would offer affected individuals two years of identity-monitoring and protection services through Experian IdentityWorks.
The breach did not involve Social Security numbers, financial account details, passwords, driver’s license information or parent data. However, students’ birth dates and addresses may have been among the information taken.
Download The California Post App, follow us on social, and subscribe to our newsletters
The California incident comes amid another cyberattack involving Canvas, a widely used online learning platform, in April and May.
Canvas is used extensively by colleges and by some K-12 schools nationwide. Students rely on the platform to submit assignments, review course syllabi and, in some cases, complete exams.
A hacking group known as ShinyHunters first breached Canvas in late April. Although the attack was thought to have been contained, the group broke into the platform again on May 7 and threatened to publish sensitive information.
Several days later, an agreement was reached with the group to recover the stolen data.
