Pull to refresh
Logo
Hack exposes data on millions of California students

Hack exposes data on millions of California students

Force in Play

A stolen login exposed personal files of every California public school student from the past three years.

Yesterday: California discloses the breach

Overview

Updated 1 hour ago

An attacker used a stolen login to spend nearly four months copying files from a server run by Educational Testing Service (ETS), the nonprofit that administers California's standardized tests. The files covered every student enrolled in California public schools over the past three school years — roughly 7 million current and former students with names, addresses, birth dates, and disability status.

California began notifying families on October 16, three weeks after ETS detected it on September 25 and took the server offline. Social Security numbers and financial account details were not copied. ETS is offering two years of free identity protection through Experian, and California agencies are reviewing the company's compliance with its data-security contract.

Why it matters

An attacker holds personal data on roughly 7 million California students, and the deadline to sign up for free identity protection is March 19, 2027.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

≈7M
Students affected
Every student enrolled in California public schools over the past three school years had data copied.
~120 days
Days of unauthorized access
The attacker copied files between May 22 and September 18, 2026, without detection.
2 years
Free identity-protection period
ETS is offering Experian IdentityWorks to affected students and their families at no cost.
Mar 19, 2027
Identity-protection enrollment deadline
Affected families must sign up for the free monitoring before this date.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

Organizations Involved

Timeline

May 2026 October 2026

4 events Latest: Yesterday
Tap a bar to jump to that date
  1. California discloses the breach

    Latest Disclosure

    CDE and ETS announce the breach and begin notifying students and families.

  2. Copying ends undetected

    Intrusion

    The attacker's last file copying occurs; the intrusion goes unnoticed for another week.

  3. Attacker begins copying files

    Intrusion

    An unauthorized party uses a stolen login to copy California student files from the ETS server.

Scenarios

1

Stolen student data resurfaces or is used in identity fraud

Uncertain Resolves by Mar 19, 2027

Discussed by: ETS and California officials, who say ongoing web monitoring has found no public release of the data so far

ETS says it has seen no evidence the copied files were made public, and law enforcement is investigating. If the data emerges on the dark web or drives identity-theft reports, the risk to minors shifts from potential to concrete. The original file-transfer site has been replaced with a new system. Families have until March 19, 2027 to enroll in the free two-year identity monitoring.

2

California penalizes ETS over testing breach

Possible Resolves by End of 2027

Discussed by: California Department of Education, which is reviewing ETS's compliance with data-security and contractual requirements

The state is examining whether ETS met its data-security obligations under the testing contract. If the review finds failures, California could impose penalties, demand corrective action, or eventually move the testing contract elsewhere. The state's settlement with the education-software firm Illuminate over a student-data breach shows enforcement is a live option.

3

Class action over ETS breach settles or is dismissed

Possible Resolves by Q2 2028

Discussed by: Pattern set by the Illuminate Education case, which ended in state enforcement and a $5.1 million settlement

Affected families may file a class action over the exposure of minors' personal data. The outcome depends on whether misuse of the data is ever proven. If no harm surfaces, courts may dismiss the claims; if fraud emerges, a settlement becomes more likely. A ruling, settlement, or dismissal would need to appear in court records within a two-year window.

Historical Context

One moment from history that rhymes with this story — and how it unfolded.

2021

Illuminate Education student data breach (2021)

Illuminate Education, an educational technology company whose products were used in California schools, suffered a data breach in 2021 that exposed the information of millions of students, including California students across 49 school districts.

Then

California, Connecticut, and New York secured a combined $5.1 million settlement, with California receiving $3.25 million.

Now

The case became California's first enforcement action under the K-12 Pupil Online Personal Information Protection Act (KOPIPA), which sets data rules for online services used in schools.

Why this matters now

It shows California has tools to penalize contractors that mishandle student data, a path state officials may follow with ETS.

Sources

(4)