Millions of California students reportedly lost their personal details to a hack. Reports have pointed out that this hack happened after hackers accessed a file transfer site run by Educational Testing Service. The nonprofit company handles statewide school tests.
The California Department of Education said the breach affected student records held by the contractor. The data may include names, birth dates, home addresses, student ID numbers, school details, disability status, and test records. However, Social Security numbers, financial details, passwords, and parents’ personal information were not affected.
The official statement revealed, “The investigation determined that an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026.”
ETS first found unusual activity on September 25. The company later learned that someone had used stolen login details to enter its file transfer site and copy student files. The unauthorized access took place between May 22 and September 18, 2026. The stolen records covered the previous three school years. ETS shut down the site, disabled the affected account, and set up a new system with stronger safety checks.
Currently, the company is working with state officials, cybersecurity experts, and law enforcement. ETS has not found evidence that the stolen data has been made public. The company is offering affected current and former students two years of free identity-protection services.
About protection from further breaches, the Educational Testing Service mentioned, “We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices.”
Further, the statement revealed, “Our priority remains the students, families and educators we serve and safeguarding the assessment programs we deliver for our clients and partners globally.”
Also Read: ASOS Cyber Breach: Hackers Accessed Customer Data Through Employee Account
Contracts with testing firms should set clear rules on data access, storage, and use. They should also require regular security checks and quick reports when a breach occurs. The contracts must explain who will inform families, help affected students, and pay for the response. State agencies should also check whether contractors follow these rules.
California officials are reviewing the incident and the company’s handling of student records. The breach is a reminder that student data needs care at every stage. Clear rules, stronger security, and quick action can help protect children’s private details and build trust among families, schools, and testing firms.