California warns all public school students of data stolen in contractor breach

Past-week coverage · Original source published 2026-10-20.

California's Department of Education (CDE) has warned that a cyberattack on assessment contractor Educational Testing Service (ETS) exposed sensitive records covering all children enrolled in the state's public schools over the last three years.

According to the CDE, the copied data includes student names, dates of birth, home addresses, schools, districts and grade levels, along with statewide and local student identifiers. It also covers gender, race or ethnicity, primary language, country of origin, English learner status, disability and Section 504 status, testing accommodations, program eligibility and statewide assessment registration, participation and results where applicable.

Those affected include current and former students enrolled between 2023 and the current school year, plus students who left a California school since 2006 without the CDE confirming a transfer.

ETS, which runs the state's CAASPP and ELPAC exams, said hackers copied information through a secure file transfer protocol site between May 22 and September 18. It discovered the breach on September 25, disabled the account used, and later took the site offline and built a new platform.

The CDE said ETS has so far found no evidence the data was made public. No group has claimed responsibility. The state began notifying families on October 16 and said notices will continue through November. The CDE said it is reviewing ETS's compliance with data security and contractual requirements, and ETS said it has paused some enrollment processing and testing activities during the investigation.

For districts and families, the practical steps are to watch for notices, confirm what data was held, and treat unexpected contact that cites student details with suspicion.