California students’ disability and test data stolen via ETS contractor breach
Hackers accessed millions of student records through compromised login details at a testing service contractor, exposing sensitive educational information.
Key points
- Attackers used stolen credentials to access an Educational Testing Service secure file transfer site between May and September.
- Data includes disability details and assessment scores for millions of current and former California public school students.
- Social Security numbers, financial accounts and passwords were not involved in the theft, according to the California Department of Education.
Millions of current and former California public school students have had their sensitive educational information stolen. The data was taken from a system operated by Educational Testing Service, a nonprofit contractor that helps run state standardized tests under agreement with the California Department of Education. The breach affects individuals enrolled in public schools during the previous three academic years, though the affected group may be broader.
What information was compromised?
The stolen files contain highly personal details about students’ education and health. According to the California Department of Education, the data may include disability information and participation in specific educational programmes. It also encompasses statewide assessment results, including test scores. The department confirmed that Social Security numbers, financial account details, passwords and parent or guardian contact information were not involved in this incident.
How did the breach occur?
An investigation by Malwarebytes Labs determined that an unauthorised party gained entry using compromised login credentials. The attackers accessed a secure file transfer protocol site operated by Educational Testing Service. They copied student information files at various times between 22 May and 18 September. TechRadar reports that the access was likely obtained through simple password theft rather than a software vulnerability, with activity discovered on 25 September.
How many people are affected?
The California Department of Education states that all students enrolled during the previous three school years are considered affected. While the exact number of impacted individuals is not officially disclosed by Educational Testing Service, Malwarebytes notes that over 5.7 million students were enrolled in California public schools during the 2025–2026 academic year alone. If the three-year figure is uniform, the total could reach approximately 17 million students, although not every individual had every category of data exposed.
What is the current status?
Educational Testing Service has found no evidence that the stolen information has been made public or released on dark web markets. The company has implemented additional safeguards, including enhanced monitoring and strengthened access controls, according to a statement cited by TechRadar. The California Department of Education is distributing breach notices to help affected individuals receive information about the incident and available resources.
What affected people can do
Teams usually advise verifying any communication about the incident through official channels before taking action. Affected individuals should check whether they have received a formal notification from the California Department of Education or Educational Testing Service. Consider enrolling in the provided identity-protection services, ensuring parents or legal guardians register for affected minors. Watch for messages that use details about your child or their school to sound convincing. Do not share passwords, security codes, or payment details in response to an unsolicited message or call. Monitor accounts for unusual activity and update passwords for related services.
Background: Dark web
The dark web matters because it hosts stolen credentials and leaked internal documents. Monitoring these channels provides early warning of compromised accounts. This intelligence allows teams to reset passwords before attackers exploit access, reducing the window for lateral movement and data exfiltration within your network.
Read the full guide: Dark Web Intelligence: Decisions, Risks and Team Usage
What to do and how to stay safe: Educational Testing Service
- Verify all breach-related communications through official government or contractor channels rather than clicking links in unsolicited emails.
- Review the specific data categories exposed for your household to understand the precise risk level for each family member.
- Enroll in the offered identity-protection services immediately, ensuring minors are registered by their legal guardians as instructed.
- Monitor financial and educational accounts for unauthorised access, and change passwords for any services where login credentials might have been reused.
Step-by-step guide: Identity Theft Protection: Answers to Critical Security Questions
General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Were Social Security numbers stolen in this breach?
No, the California Department of Education confirmed that Social Security numbers, financial account information and passwords were not involved.
Who is responsible for notifying affected families?
Educational Testing Service is notifying affected students and families at the direction of the California Department of Education.
Is there evidence the data has been leaked publicly?
Educational Testing Service says it has found no evidence so far that the stolen information has been made public.
