A compromised login opened the file-transfer site used to exchange California’s statewide testing information. An unauthorized party copied student files at various points between May 22 and September 18, 2026. The California student data breach was detected on September 25, according to the official notice from Educational Testing Service (ETS).
The immediate development is the notification effort, which began on October 16—not a newly discovered intrusion this weekend. California’s Department of Education says distribution is expected to continue through early November. ETS administers statewide assessments under contract with the state.
The scope reaches millions of students. Reuters reports that the affected information includes records for all students enrolled during the three previous school years. That is not a precise count of unique victims, and the official notice does not limit the affected population to current students.
What the California student data breach exposed
The files can contain names, birth dates, home addresses, student identifiers, demographic details, disability status, testing accommodations and assessment information. Not every record contains every category. Social Security numbers, financial account information, passwords and parents’ or guardians’ personal information were not involved, according to the state’s announcement and notice.
Those exclusions matter, but so does the sensitivity of the remaining information. A child’s address and disability-related details are personal even without a bank account attached. This is a breach of files held by a testing supplier, not evidence that every affected school’s own systems were penetrated: Irvine Unified explicitly says its systems were not breached.
ETS disabled the compromised account and took the affected site offline. California says the company built a new file-transfer site with enhanced controls. As of the October 16 announcement, ETS’s web monitoring had found no evidence that the information had been made public. That is narrower than saying the copied files are harmless or have been recovered.
Where families can find help
ETS is offering affected current and former students two years of complimentary Experian IdentityWorks protection, with separate options for minors and adults. The official incident page provides notices, enrollment information and updates. Families should use those official resources to verify communications; Irvine warns against sharing personal, financial or account information in response to unexpected messages about the incident.
The larger lesson is a supply-chain boundary with very human consequences. A school can avoid a breach of its own network and still have its students’ information copied elsewhere. Securing the contractor’s next transfer does not undo the exposure of the last one.
