Hackers accessed personal data of millions of California public-school students
A breach at the Education Testing Service exposed names, demographics and disability information for all K-12 students enrolled in California public schools over the past three years.
California’s public-school system suffered a massive data breach after hackers exploited a compromised credential to access an SFTP site managed by the Education Testing Service. The breach, uncovered on September 25, 2026, involved the theft of names, demographic details and disability status for every student enrolled in state schools during the previous three years. ETS promptly disabled the offending account, removed the SFTP site from operation, and engaged outside cybersecurity specialists.
The investigation determined that the unauthorized party accessed the server at various times from May 22 to September 18, 2026, extracting files that held statewide assessment information. The California Department of Education confirmed the scope of the breach and is working with ETS to assess the impact and strengthen security measures.
Why it matters
Millions of students' personal data were exposed, raising privacy concerns and prompting a review of education-system security.
In this story
