Hackers steal data of 7 million California public‑school students

State officials announced Friday that hackers stole personal information belonging to about seven million California public‑school students.

The breach raises serious privacy concerns for families and highlights the growing vulnerability of education data systems, prompting calls for stronger cybersecurity across school districts.

Stolen records included students’ names, home addresses, demographic information and disability status. Social Security numbers, financial data, passwords and parent or guardian details were not compromised.

The attack targeted the Educational Testing Service (ETS), a nonprofit that contracts with the California Department of Education to administer statewide assessments such as the California Assessment of Student Performance and Progress and the English Language Proficiency Assessments for California.

According to the department, unauthorized activity was first detected on September 25, 2026 when ETS identified suspicious access to an SFTP site used for transferring assessment data. ETS disabled the compromised account, took the site offline and launched an investigation with external cybersecurity experts.

Investigators determined that a compromised login credential was used at various times from May 22 to September 18, 2026 to copy files containing student information. ETS has since rebuilt the file‑transfer system with enhanced security controls and is monitoring the new platform closely.

The California Department of Education notified affected families on October 16, 2026 and urged schools to review and improve their digital security practices. Officials emphasized that protecting student data is a shared responsibility among state agencies, vendors and local districts.

The investigation remains ongoing, with state and federal authorities working to identify the perpetrators and assess any further risks to the education community.