Hacker Breaches Educational Testing Service, Exposing Data of Millions of California Students

The California Department of Education announced that a hacker accessed personal data for millions of students by exploiting systems belonging to a non-profit contractor, Educational Testing Service. The unauthorized access exposed names, birth dates, addresses, and disability status for all students enrolled in the state over the three previous school years, a period encompassing more than 5.7 million students in the 2025-2026 academic year alone. An investigation determined the attacker used a compromised login credential to access a secure file transfer protocol site, copying files at various times between May 22 and September 18, 2026. The department confirmed that Social Security numbers and sensitive financial information were not compromised, and there is no evidence the stolen data has been made public so far. Educational Testing Service has halted normal enrollment data processing while implementing enhanced access controls and third-party security reviews. "We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices. Our priority remains the students, families and educators we serve and safeguarding the assessment programs we deliver for our clients and partners globally." — Educational Testing Service