LOS ANGELES, October 17, 2026 — Hackers accessed the personal information of millions of current and former California public school students through a compromised ETS login credential between May and September 2026.
How the Breach Occurred
An unauthorized party used a compromised login credential to access an SFTP site operated by Educational Testing Service (ETS) and copy files containing California student information, according to the California Department of Education. The intrusion occurred at various times between May 22 and September 18, 2026. ETS discovered the hack on September 25 and subsequently disabled the account involved, took the affected SFTP site offline, and initiated an investigation with the assistance of external cybersecurity experts.
Scope of Data Stolen
The exposed information includes names, addresses, demographic details, disability information, grade level, date of birth, school and district attended, unique student identifier numbers, gender, race or ethnicity, primary language, country of origin, English learner status, and eligibility for federal programs such as those assisting low-income families. The data also covers students who participated in state-mandated standardized tests, including the Smarter Balanced assessments and the California Assessment of Student Performance and Progress (CAASPP). Officials confirmed that Social Security numbers, driver’s license numbers, passport numbers, financial account information, credit or debit card information, account passwords, and parent or guardian personal information were not included in the breach.
Timeline and Affected Population
The breach affects not only California’s current 5.7 million public-school students but also former students dating back to 2006 enrollments, including those who left the state without confirming transfer to another school. The compromised information spans multiple years due to the retention of historical data by ETS in its role managing statewide assessments for California K-12 public schools. State officials noted that the number of individuals impacted exceeds the current student population because of the historical scope of the data stored.
Response and Mitigation
State officials said those affected are eligible for 24 months of free identity-protection services and identity-restoration help. ETS halted normal enrollment data processing and paused certain testing activities while the security of its systems is assessed. The company also decided to provide identity protection services through Experian IdentityWorks for two years. The investigation remains ongoing, with ETS working alongside state agencies and external experts to determine the full scope and impact of the incident.
Broader Context and Historical Precedents
The California incident is not the first time a compromised login credential has led to significant data exposure. In late April of this year, the learning management platform Canvas was hacked by a group called ShinyHunters. After an initial breach in late-April was believed to be contained, the same group returned on May 7 to hack Canvas again and threatened to release sensitive data. An agreement with the group was eventually reached a few days later to reclaim the stolen information. This pattern highlights how cybercriminals often exploit previously compromised credentials or return to targets after containment attempts.
Nationally, healthcare data breach statistics compiled by the HIPAA Journal show a clear upward trend since 2009 when the Department of Health and Human Services Office for Civil Rights began publishing summaries. The number of large breaches peaked in 2026 with 772 incidents affecting 500 or more individuals reported to OCR. Between 2022 and 2023, while the number of reported large healthcare data breaches increased by around 3.8%, the number of affected individuals surged by more than 193%. Similarly, between 2023 and 2024, despite a 0.5% decline in reported large breaches, the number of affected individuals soared by 58% to more than 289 million people in a single year.
The California Department of Education noted that while this specific breach dates back to 2023 enrollments and includes students from 2006, it affects more than the current population of 5.7 million public-school students because ETS retains historical data. This retention practice means that even former students who left the state without confirming their transfer to another school were impacted. The sheer volume of affected individuals in recent years suggests that organizations managing large datasets must remain vigilant against credential compromise, as a single unauthorized party using a compromised login can expose millions of records over an extended period.
Sources
- Hackers steal personal data of millions of California students in massive breach
- Hackers steal sensitive personal info from millions of California students in massive breach
- Healthcare Data Breach Statistics
Photo: Educational Testing Service (CC BY-SA 4.0)
