Short answer
The California Department of Education said on October 16, 2026 that an unauthorized party copied student data from a file transfer site run by its testing contractor, Educational Testing Service (ETS), between May 22 and September 18. The state says Social Security numbers and financial information were not involved and that no evidence of public release has been found.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | California Department of Education / Educational Testing Service (ETS) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Education |
| Country | United States |
| Detected | 2026-09-25 |
| Disclosed | 2026-10-16 |
| People or records affected | Current and former California public school students, including all students enrolled in the three previous school years (more than 5.7 million were enrolled in 2025 to 2026) |
What data was exposed
- Names, dates of birth and home addresses
- Statewide Student Identifiers (SSIDs), school, district and grade level
- Gender, race or ethnicity, primary language, country of origin and English learner status
- Disability and Section 504 status, testing accommodations
- Eligibility for programs such as Title I and McKinney-Vento
- Statewide assessment registration, participation and results
What happened
The California Department of Education (CDE) announced on October 16, 2026 that student records had been copied from a system run by one of its contractors. Educational Testing Service, a nonprofit, helps run the state’s CAASPP and ELPAC exams. According to The Record, an outsider pulled files from an ETS secure file transfer site at various times between May 22 and September 18, 2026.
The CDE said the intruder used a compromised login credential. ETS spotted the activity on September 25, disabled the account, took the site offline and built a replacement platform. School district leaders were told on October 2, and families started receiving letters on October 16.
Who is affected
The state says the group includes all students enrolled in California public schools during the three previous school years. California enrolled more than 5.7 million students in 2025 to 2026, but the affected total is likely larger because it spans several years. GovTech adds that students who left a California school since 2006 without a confirmed transfer are covered too. No official count has been published.
Not every person had every field exposed. Disability status and program eligibility are the most sensitive items on the list, because they reveal details about a child’s health and family circumstances.
How the organizations responded
ETS said it added enhanced monitoring, stronger access controls and extra third-party security review, and that no other ETS customers were affected. It also halted normal enrollment data processing and paused some testing activity while it checks its systems. The CDE said it is reviewing whether ETS met its data-security and contract requirements.
The CDE says ETS has found no evidence the data has been published. No hacking group has claimed the theft, and neither has said whether a ransom demand was made.
What families should expect
Data like this is useful for convincing messages. A scammer who knows a child’s school, grade and test accommodations can write a note that looks like it came from a teacher or district. Read our guide to phishing messages and the steps in what to do after a data breach. Messages that pose as officials are covered in government impersonation scams.
What is still unknown
The exact number of people affected has not been published. Neither the CDE nor ETS has said who was behind the intrusion, why the credential was able to reach the files for four months, or how long the data had been stored there. We will update this page when the state posts new figures. See our editorial policy for how we handle updates.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails or texts that mention a child's school, grade or test results to look like official school or state notices
- Fake messages claiming to be from ETS, the state or a credit monitoring company that ask you to 'verify' enrollment in free protection
- Calls or messages about disability services, accommodations or special programs that ask for payment or a Social Security number
- Identity theft attempts targeting children, whose credit files are rarely checked
What to do if you are affected
- 01Read the notice from the California Department of Education or your district and confirm it through the CDE incident page, not through links in a message.
- 02Enroll in the 24 months of free identity protection ETS is offering. Parents or guardians enroll minors, and adults who attended school in California enroll themselves.
- 03Parents and guardians of children under 16 can request a free credit freeze for their child from the credit bureaus.
- 04Do not share passwords, security codes, payment details or Social Security numbers in response to unexpected emails, calls or texts about the incident.
- 05Treat any message that cites your child's school or test details with suspicion, and call the school using a number you already have.
Frequently asked questions
Was my child's data part of the California ETS breach?
The state says all students enrolled in California public schools in the three previous school years are affected. Students who left a California school since 2006 without a confirmed transfer may also be included. Watch for a notice from CDE, which began notifying families on October 16 and will keep sending notices through November.
Were Social Security numbers stolen in the California student data breach?
According to the California Department of Education, no. It says Social Security numbers, driver's license and passport numbers, financial account information, passwords and parent or guardian information were not involved.
How did hackers get into the ETS system?
The department said an unauthorized party used a compromised login credential to reach a secure file transfer site and copy files. ETS disabled the account and took the site offline.
Is there free identity protection for affected California students?
Yes. ETS is offering 24 months of free identity protection and identity restoration help, including to adults who attended school in the state. Parents can also request a free credit freeze for children under 16.
Has the stolen student data been published?
As of the latest reports, The CDE says ETS has found no evidence the information was made public, and no hacking group had claimed responsibility as of The Record's report.
Sources
- California warns all public school students of data breach, The Record, 2026-10-17
- Testing company data breach affects millions of Calif. students, GovTech, 2026-10-19
- Millions of California students' sensitive data stolen in breach, Malwarebytes, 2026-10-19
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.