California Student Data Breach Raises Concerns

Millions of current and former California public school students may have had their sensitive personal information stolen in a major data breach involving a state testing contractor. This situation has introduced serious concerns about the security of student records and the protocols in place to protect children’s personal details.

Extent of the Data Breach

Hackers gained access to sensitive records, including home addresses, birth dates, and disability details of public school students in California. Notably, even if you now live far from California, you might still be affected if you or your child attended a public school there in the past.

How the Breach Occurred

The breach involved Educational Testing Service (ETS), a nonprofit that administers state assessments. An attacker used compromised login credentials to access an ETS-operated secure file transfer site, allowing them to copy files containing student information multiple times from May to September 2026. ETS discovered this activity in late September and disabled the affected account, taking corrective measures to prevent further breaches.

Types of Stolen Information

The breach exposed more than test scores. It involved:

• Student names and birth dates
• Home addresses and school information
• Statewide and local student identification numbers
• Personal details like race, language, and disability information

Although social security numbers and financial details were not stolen, the available information could lead to fraudulent activities.

Impact Beyond California

The breach affects former students who previously attended California schools. This includes individuals who transitioned out of public schooling since 2006 without having their transfer confirmed. This means old records of students now living elsewhere could have been compromised.

Investigation and Response

The California Department of Education is working with cybersecurity specialists to investigate the breach and ensure compliance with data security protocols. ETS reports that it has implemented additional safeguards to prevent future incidents and continues to monitor for unauthorized access.

Notifications and Identity Protection

ETS began notifying affected individuals in mid-October. These notifications contain details about the breach and information about complimentary identity protection services being offered.

Steps to Take if Affected

Families are advised to:

• Verify breach notifications through official channels before responding
• Consider utilizing free identity protection services
• Place a security freeze on children’s credit files where applicable
• Monitor for suspicious messages that could exploit the data breach
• Take steps to remove personal information from the internet
• Check for signs of identity theft
• Understand how their child’s school manages and stores student records

Concerns Regarding Long-Term Data Retention

Questions arise about schools and testing companies retaining sensitive records for extended periods. There’s a need for transparency about the duration and reasons for maintaining such records, and whether families should have more control over the deletion of this information after leaving the school system.