California is notifying current and former public school students after an intruder copied sensitive records from a file-transfer system operated by Educational Testing Service, or ETS. The exposed data did not include passwords or Social Security numbers, but it contained enough personal and educational information to make the notices important for affected families.
What happened
An unauthorized person used a compromised login to enter an ETS secure file transfer protocol site, according to SecurityWeek. ETS supports California’s state and federally required student testing programs under a contract with the state.
The unauthorized access occurred at various times from May 22 through September 18, 2026. ETS detected the activity on September 25. The California Department of Education said files were accessed and copied, but officials have not disclosed how the login was compromised or identified the attacker.
ETS disabled the compromised account and took the file-transfer site offline. It is also building a replacement system with stronger protections. The organization said monitoring has not found evidence that the copied information was published online, but it did not explain what steps were taken to reduce that risk.
Student notifications began October 16 and are expected to continue into early November.
Who is affected
The exact number of affected students has not been disclosed. State officials said the copied files included information about all students enrolled during the previous three school years. California had more than 5.7 million public school students during the 2025–2026 school year, according to enrollment figures cited by SecurityWeek.
Some former students may also be affected. The exposed population extends as far back as 2006 for students who left a California school and whose transfer to another school was not confirmed with the state.
The records may contain names, birth dates, home addresses, schools, districts, grade levels, student identification numbers, gender, race or ethnicity, primary language, country of origin, English-language status, testing information and results. Some records may also disclose disabilities, testing accommodations, or participation in certain education and assistance programs.
The files did not contain Social Security numbers, passwords, payment card details, financial account information, or information about parents and guardians.
What to do now
Watch for an official notification. Check mail and messages from your school, district and the California Department of Education through early November. Keep the notice because it should contain the instructions intended for affected students.
Verify messages before following links. If an email or text claims to concern the breach, contact the school or district through its official website or a phone number you already trust. Do not provide passwords, payment information or verification codes in response to an unexpected message.
Enroll in the offered protection. Affected current and former students can receive two years of free identity protection services. Follow the enrollment directions in the official notice and complete the process by any deadline stated there; a public deadline has not been disclosed.
Prepare children for targeted messages. Explain that a convincing message may mention their school, grade or other real details. Tell them not to reply, open attachments or approve account requests without showing a trusted adult. CyberSec24’s family protection checklist can help households establish simple verification rules.
Do not change passwords solely because of this incident. Officials said passwords were not present in the copied files. However, immediately change a password if a suspicious breach-related message led anyone in the household to enter it on another site.
Sources
Written by the CyberSec24 news desk with AI assistance, from the sources above. Spot an error? Tell us and we'll correct it.