ETS breach exposes California student records

Hackers accessed the file-transfer systems of ETS from May 22 to September 18, 2026, exposing records of California public school students and some former students whose data goes back to 2006.

The exposed information consisted of student IDs, names, addresses, birth dates, demographic details, assessment results and disability information. According to ETS, the intruders failed to access Social Security numbers, financial details, passwords or any parent or guardian data. On September 25, ETS identified the unauthorized access, disconnected its SFTP (Secure File Transfer Protocol) server and created a new version with tighter security measures. ETS runs California’s statewide testing programs, which include the California Assessment of Student Performance and Progress and the English Language Proficiency Assessments for California.

The California Department of Education announced the breach publicly on Friday, October 16, 2026. Starting October 16, 2026, ETS initiated notifications to affected students and their families, noting that the process would run through early November. The state is providing two years of free Experian IdentityWorks identity‑protection services to affected current and former students.

On October 2, ETS told county and district school officials that it had halted normal enrollment data processing. ETS said it had added enhanced monitoring, stronger access controls, and commissioned a third‑party review of its security practices. As of Friday, ETS stated that no proof exists that anyone has released the stolen data publicly.

Updates

Update · October 19, 2026
Hoodline reported on Oct. 18 that Politico estimated personal information tied to all 7 million students enrolled in California public schools over the past three school years was exposed, and that officials said the stolen data did not include Social Security numbers, driver's license numbers, passport numbers, financial account information, credit or debit card information or account passwords. The Los Angeles Times also noted that some of the affected records date back to 2023 enrollments.
Update · October 19, 2026
Malwarebytes reported on Oct. 19 that the intrusion into ETS’s SFTP site involved the use of compromised login details between May 22 and Sept. 18. It also said the California Department of Education stated the breach affects all students enrolled in the state’s public schools over the previous three school years, citing over 5.7 million students enrolled in the 2025‑2026 school year.
Update · October 18, 2026
Pasadena Unified School District said Saturday it is assessing any potential impact on the district from the breach, adding that its systems 'are currently up and running,' and that it is monitoring the state's ongoing investigation and will share additional information as it becomes available. Reuters reported that millions of students' data was accessed, and the California Department of Education said the exposed information may include names, birth dates, home addresses, schools, grade levels, student IDs, gender, race or ethnicity, primary language, country of origin, English learner status, disability and Section 504 status, testing accommodations, eligibility for programs such as Title I and McKinney‑Vento, and state test registration, participation and results, while also noting enrollment deadlines of March 19, 2027 for students under 18 and March 19, 2029 for adults. ETS said it has built a new file transfer site with enhanced security controls and implemented additional safeguards including enhanced monitoring, strengthened access controls, and further third‑party review, and the department and State Board of Education are reviewing the incident and ETS's compliance with applicable data security and contractual requirements, warning against sharing Social Security numbers, passwords or financial information in response to unsolicited requests about the incident.

Was this helpful?

Join the discussion Cancel reply

Share

Was this helpful?

Related

Join the discussion Cancel reply

Most read