Cyberattack exposes personal data of millions of California students

A cyberattack on a nonprofit contractor working with California’s education department has exposed the personal information of millions of students, including their names, dates of birth, home addresses and disability status.
The California Department of Education disclosed the breach on Friday, saying the stolen data covered students enrolled during the past three academic years.
More than 5.75 million students were enrolled in California educational institutions in the 2025-26 academic year alone, highlighting the potential scale of the incident.
The breach involved Educational Testing Service (ETS), which conducts state-level assessments in California, including tests to evaluate students’ English language proficiency.
The security breach was first detected in late September on a secure file-transfer site operated by the contractor. An investigation found that an unauthorised user had accessed the site using stolen login credentials and copied files containing California students’ information.
The unauthorised access occurred at some point between May 22 and September 18 this year, according to the investigation.
There is no indication so far that the stolen information has been publicly distributed. The breach also did not expose students’ Social Security numbers or sensitive financial information, officials said.
ETS has begun notifying affected students and their families about the incident.
The company has also introduced additional security measures, including enhanced data monitoring, stronger access controls and further independent reviews of its security systems, to prevent similar incidents.
The breach raises concerns about the protection of sensitive student information held by third-party contractors and the cybersecurity risks associated with the growing use of digital systems in education.