The Scope of Stolen Information
Hackers have successfully exfiltrated the personal records of millions of current and former students enrolled in California public schools, a breach that dates back to 2023 enrollments.
The compromised data includes names, addresses, demographic details, and disability information for students who took state-mandated standardized tests annually.
This incident specifically targeted the Educational Testing Service or ETS, a nonprofit organization that administers standardized testing for California K-12 public schools.
ETS manages statewide assessments such as the California Assessment of Student Performance and Progress and the English Language Proficiency Assessments for California.
The stolen dataset extends beyond current enrollments to include students who left California but did not confirm their transfer to another school, dating back to 2006.
According to officials, the exposed information also includes student grade level, date of birth, and the specific school and district each student attends.
The unauthorized actors obtained access to unique student identifier numbers as well as information about gender, race or ethnicity, primary language, country of origin and English learner status.
Also exposed was information about student disabilities and student eligibility status for federal programs, such as those available to help students from low-income families.
The technical reality is that the breach did not include Social Security numbers, driver’s license numbers, passport numbers, financial account information, credit or debit card information or account passwords.
Nor was parent or guardian personal information exposed, according to state officials who reviewed the forensic data logs.
Immediate Legal Obligations for District Officials
State education officials are urgently working with a team of state agencies to investigate and determine the full scope and impact of the incident.
District leaders received word on October 2, while the first public notice was issued on Friday, October 16, 2026.
The investigation determined that an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026.
This method of infiltration involved an SFTP site used to exchange California statewide assessment information with the California Department of Education.
ETS disabled the account involved and took the affected SFTP site offline immediately after identifying unauthorized activity on September 25, 2026.
The company initiated an investigation with the assistance of external cybersecurity experts to trace the origin of the compromised credentials.
As a result of the incident, ETS halted normal enrollment data processing and paused certain testing activities while the security of its systems were assessed.
Officials have not yet uncovered any evidence that information made public by the breach has been used for malicious purposes outside of California.
Notification Requirements Under State Law
ETS is providing identity protection services through Experian IdentityWorks for two years to affected families and individuals.
District officials are required to notify families of affected students and provide them with information on how to protect their personal data.
The state of California has established a precedent where those affected by the breach are eligible for 24 months of free identity-protection services and identity-restoration help.
State Deputy Superintendent Mary Nicely issued a letter confirming that officials are determining what information may have been affected during the intrusion.
The notification process involves distributing detailed lists to affected districts so they can inform parents and guardians directly about the specific data exposed.
This requirement ensures that families understand the nature of the theft and can take necessary steps to safeguard their identities against potential fraud.
Securing Systems to Prevent Future Breaches
The breach is considered significant due to its scale, affecting all students enrolled in the state public schools over the past three years.
Canvas is widely used throughout colleges and in some K-12 schools across the country for students to upload homework, check the syllabus and even to take tests.
The platform was originally hacked in late-April by a group called ShinyHunters, which replaced the login page with a ransomware message on May 7.
Despite an agreement eventually being made a few days later to reclaim the stolen data from that earlier incident, the California breach represents a separate vector of attack.
The technical detail that matters here is that the unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times.
ShinyHunters claimed responsibility for the Canvas hack and threatened to release sensitive data unless a ransom was paid by May 12, though access was restored to most users shortly after.
Instructure, the operator of Canvas LMS, disclosed that it was investigating a cybersecurity attack involving certain user data, including names, email addresses, student ID numbers, and messages among users.
The company said it had found no evidence that passwords, birth dates, government IDs, or financial information were involved in the hacking of their systems prior to this specific California incident.
While Instructure reported no incidents related to the May 7-8 hack as of May 8, the ongoing nature of such threats highlights the need for continuous system monitoring.
A proposed class action lawsuit was filed against Instructure in the United States District Court for the Southern District of California on behalf of a San Diego resident due to the release of personally identifiable information.
Support Resources for Affected Individuals
State officials have confirmed that families impacted by this incident are eligible for 24 months of free identity-protection services and identity-restoration help through Experian IdentityWorks.
This support is part of the notification process, which involves distributing detailed lists to affected districts so they can inform parents and guardians directly about the specific data exposed.
ETS is providing these services for two years to address potential fraud risks associated with the stolen names, addresses, demographic details, and disability information.
Sources
- 2026 Canvas data breach
- Hackers steal personal data of millions of California students in massive breach
- Hackers steal sensitive personal info from millions of California students in massive breach
Photo: G. Edward Johnson (CC BY 4.0)
