Hackers quietly copied years of California student records from a state testing vendor’s file system, exposing data on millions of children and teens.
Story Snapshot
- Officials confirmed unauthorized access to an Educational Testing Service file site used for state assessments.
- A compromised login was used from May to September 2026 to copy student files.
- Records include names, addresses, demographics, and education details; no Social Security numbers were involved.
- California education officials said data for about 7 million students across three school years was exposed.
What Officials Say Was Breached
California’s attorney general posted a notice from Educational Testing Service that describes a confirmed intrusion into a secure file-transfer site used with the California Department of Education. The notice says an unauthorized party used a stolen credential to access and copy files holding student information. Listed fields include name, date of birth, address, school, district, grade, statewide and local student identifiers, gender, race or ethnicity, primary language, country of origin, and English-learner status. The notice excludes Social Security and financial data.
Politico reported that the California Department of Education said the exposure covered roughly all students enrolled in public schools over the last three school years, about seven million people. That scale matches the vendor’s role in statewide testing but was not itemized in the notice itself. The department had earlier acknowledged a vendor incident and said the state was working to define scope and impact while some testing activities were paused during the review.
How the Intrusion Happened and When
The breach notice states the attacker used one compromised login credential to enter the secure file-transfer site at different times between May 22 and September 18, 2026. Educational Testing Service identified suspicious activity on September 25 and then disabled the account, took the site offline, and launched an investigation with outside experts. The company also notified law enforcement. The method raises basic questions about password security and whether stronger login checks, such as multi-factor authentication, were active on the account at the time.
The California Department of Education’s public incident page confirms the vendor notified the department and the State Board of Education. It also says the state began its own review of what information was involved and the number of students affected. That staged response is common when education agencies rely on private testing contractors to exchange large record sets and must coordinate investigations with multiple parties.
What Was Not Included and Why It Still Matters
The breach notice says the copied files did not include Social Security numbers, driver’s license numbers, passports, bank accounts, payment cards, or passwords. That reduces the risk of direct financial fraud. But the files did contain names, addresses, student identifiers, and sensitive education and demographic details. Those fields can still enable targeted scams, harassment, or profiling. Families may need to watch for phishing using accurate school and district names that make fake messages seem real.
Federal guidance under the Family Educational Rights and Privacy Act does not impose detailed cybersecurity rules or a general breach-notice mandate on schools. Agencies and vendors must rely on contracts, state law, and internal policy for data protection and incident response. Official toolkits focus on best practices and parent guidance rather than strict technical standards. That gap leaves large student datasets exposed to uneven vendor controls across states and programs.
Scale, Accountability, and Next Steps
California’s education system depends on outside companies to run testing and handle file exchanges for millions of students. When one vendor’s guard drops, families across the state feel it. Educational Testing Service says it is working with investigators and has taken the affected system offline. The department’s early report confirms state oversight is active, but it also shows how complex it is to size and trace an incident across several school years before final forensics are complete.
Parents and teachers will want clear answers on core issues: which exact files were copied, how the login was stolen, whether multi-factor checks were in place, and how fast every agency and contractor will harden similar systems. Contract terms, audit results, and vendor risk reviews should face new scrutiny. This is not a red or blue problem. Families across the spectrum expect schools and their partners to guard children’s data with the same care they guard grades and safety.
Sources:
nypost.com, politico.com, oag.ca.gov, cde.ca.gov, privacyrights.org
