MILLIONS of California public school students have had their personal information exposed after an unauthorized party accessed an Educational Testing Service (ETS) operated file transfer site used under a contract with the California Department of Education (CDE). The breach occurred when compromised login details allowed access to files containing student data at various times between 22 May and 18 September.
The CDE states the breach covers all students enrolled during the previous three school years, though affected individuals may extend beyond that group. In total, more than 5.7 million students were enrolled in California public schools in the 2025–2026 school year.
The data involved varies by individual but may include student names, Statewide Student Identifiers (SSIDs), dates of birth, home addresses, demographic information, disability and programme participation information, and Statewide assessment information, including test scores.
The California Education Department emphasises that Social Security numbers, financial account information, passwords, and parent or guardian information were not involved, and ETS reports no evidence thus far that stolen data has been made public. In response, ETS, at the CDE’s direction, is notifying affected students and families and offering two years of free identity-protection services.
Recipients are advised to verify communications through official channels, be vigilant for phishing attempts phrased with school-specific details, and avoid sharing passwords or payment details in response to unsolicited contact.