The California Department of Education said on Friday that a hacker accessed the data of millions of students, including names, birth dates, addresses and disability status, by exploiting the system of a non-profit contractor that works with the state. The hacker accessed the data of “all students enrolled in the three previous school years,” the department said. More than 5.7 million students were enrolled in California during the 2025-2026 school year, according to the department, which means the total number of affected records could run considerably higher once students from the two prior academic years are counted.
The non-profit, Educational Testing Service, on Friday began notifying students and their families of the breach, which was identified late last month but found to have been ongoing since May, the education department said. The non-profit identified the breach involving a secure file transfer protocol site on September 25 and began an investigation, according to the California agency. “The investigation determined that an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026,” the education department said. The timeline is among the most troubling aspects of the incident. Nearly four months passed between the first unauthorized access in May and the discovery of the breach in late September, a window during which files could be copied repeatedly without triggering an effective alarm.
Educational Testing Service has not found that any of the information has been made public so far, the education department said, adding that Social Security numbers and sensitive financial information were not accessed. That detail offers some reassurance to families, since the exposure of names, birth dates and addresses alone is generally not sufficient for direct financial fraud, though it can enable identity theft, phishing and social engineering attempts that rely on accurate personal details to appear credible. The inclusion of disability status in the compromised data raises particular concerns, because that information is among the most sensitive categories of student records and carries privacy implications that extend well beyond financial risk.
In an October 2 letter to county and district school officials, the California agency said the testing service had stopped “normal enrollment data processing.” “The CDE is actively working to minimize disruption and resume affected assessment activities in a timely manner,” the department said. The suspension of normal processing illustrates how deeply a single contractor’s security failure can ripple through the state’s education system. In California, Educational Testing Service administers statewide assessments including those for English language proficiency, meaning the disruption touches testing schedules, reporting requirements and the work of district administrators who depend on the contractor’s systems to enroll and track students.
The breach also highlights a structural vulnerability that has become familiar across state and local government. Agencies frequently rely on outside contractors to handle sensitive data, and the security of public records then depends on the practices of a third party whose systems the agency does not directly control. In this case, a single compromised login credential was enough to open access to files covering millions of students across multiple school years. The education department’s account does not specify how the credential was obtained or whether multi-factor authentication was in place on the file transfer site, questions that are likely to feature prominently in any subsequent review of the incident.
