Stolen ETS login exposed data on millions of California students for months

Personal data on millions of current and former California public school students was stolen from the Educational Testing Service (ETS), the nonprofit contractor that administers the state's mandated standardized tests, according to the Los Angeles Times. Citing the California Department of Education (CDE), the newspaper reported that an unauthorized party used a compromised login credential to copy student files at various times between May 22 and Sept. 18, 2026. The incident is one of the largest student data exposures disclosed in the United States this year.

What happened

According to the Los Angeles Times, ETS discovered the intrusion on Sept. 25. School district leaders were informed on Oct. 2, and the first public notice came on Friday, Oct. 16. The newspaper said the state's release did not mention whether a ransom demand had been made, and officials said they had found no evidence that the data has been published.

State Deputy Superintendent Mary Nicely wrote that education officials "are urgently working with a team of state agencies to investigate and determine scope and impact of the incident," the paper reported. ETS spokesperson Christine Betaneli said the organization maintains a security program that is regularly assessed by third parties, that no other ETS customers were affected, and that ETS has added enhanced monitoring, stronger access controls and further third-party review.

Who is affected

The Los Angeles Times reported that the breach reaches beyond California's current 5.7 million public school students because it goes back to 2023 enrollments. Students who left the state without a confirmed transfer to another school are also affected, with records dating back to 2006.

Exposed information includes names, addresses, disability records, grade level, date of birth, school and district, unique student identifiers, gender, race or ethnicity, primary language, country of origin, English learner status and eligibility for federal programs such as those for low-income families. Officials said Social Security numbers, driver's license and passport numbers, financial and card data, account passwords and parent or guardian information were not exposed.

Anton Dahbura of the Johns Hopkins University Information Security Institute told the paper that a stolen login credential "should not become a months-long passport" to millions of students' records.

What to do

Affected former students, including those who are now adults, are eligible for 24 months of free identity-protection services and identity-restoration help, according to the report. Officials suggested that parents or guardians of children under 16 consider requesting a free credit freeze. They also warned families to be cautious of unexpected emails, calls or texts about the incident, including messages claiming to come from ETS, the state or a credit monitoring company, and not to share Social Security numbers, passwords or financial details in response. The CDE posts updates on its ETS incident webpage.

For organizations, the case is a reminder that contractor accounts with access to bulk data need multi-factor authentication, anomaly monitoring on large file transfers and regular access reviews.