Personal information on current and former California public school students was copied from a file transfer system belonging to Educational Testing Service (ETS), according to the California Department of Education (CDE).
ETS is a nonprofit that handles state and federally mandated testing under a contract with the state. The organization supports California’s CAASPP and ELPAC assessment programs and relied on a secure file transfer protocol (SFTP) site to share testing data with CDE.
The organization spotted unauthorized activity on the site on September 25, but the earliest access dates back to late May.
“The investigation determined that an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026 to access the SFTP site to copy files containing California student information,” according to the CDE’s breach notice.
No victim count has been provided, but the notice says, “Information about California students, including but not limited to all students enrolled in the three previous school years, was accessed and copied.”
CDE’s own enrollment figures put that in perspective: more than 5.7 million students were enrolled in California public schools in 2025-2026. The department’s incident FAQ notes that the impacted population also extends to students who left a California school as far back as 2006 and whose transfer to another school was not confirmed with CDE.
Compromised records can include information such as student name, birth date, home address, school, district and grade, state and local ID numbers, gender, race or ethnicity, primary language, country of origin and English learner status.
Some entries go further, revealing disability and Section 504 status, the primary disability type, testing accommodations, English proficiency data, and test registration and results. They may also indicate whether a student qualifies for Title I, McKinney-Vento or military-connected student designations.
The notice says the files did not contain Social Security numbers, passwords, or financial account or payment card details. Information on parents and guardians was not involved either.
ETS shut down the account the intruder used and pulled the SFTP site offline. Its response also includes building a replacement site with stronger safeguards.
The official disclosures do not explain how the login credential was compromised, and they do not identify the attacker.
“After working with law enforcement as well as with cybersecurity experts, ETS has taken steps to reduce the potential risk of the data being made publicly accessible,” the notice states. ETS did not elaborate, but said its web monitoring has so far found no evidence that the data has been published.
CDE informed county and district superintendents and charter school administrators of the incident in a letter dated October 2, two weeks before family notifications started. According to that letter, ETS stopped its regular processing of enrollment data and suspended some testing work while its systems’ security was evaluated.
Student notifications started going out on October 16, and CDE expects them to continue into early November. Affected current and former students can sign up for two years of free identity protection services.
Related: Deal Reached With Hackers to Delete Data Stolen From the Canvas Educational Platform
Related: Mount Royal University Confirms Data Stolen in Ransomware Attack
