California Education Data Breach Exposes Records of 7 Million Students
A data breach at the Education Testing Service (ETS) exposed the personal information of 7 million California students. The California Department of Education (CDE) announced the incident on October 16, 2026. The breach involved names, addresses, demographic data, and disability status for students enrolled in public schools over the past three years. ETS, a non-profit that administers standardized tests like the Smarter Balanced exam, confirmed the intrusion. An unauthorized party used a compromised login credential to copy files between May 22 and September 18. ETS discovered the breach on September 25, days after the activity ended. The company took the affected server offline and disabled the compromised account. Law enforcement is investigating the incident. Parents and students began receiving notifications from state officials on Friday.
Key points
- The breach affected 7 million students in California public schools over the last three school years.
- Exposed data included names, addresses, demographic information, and disability status.
- The Education Testing Service (ETS) was the target of the hack.
- The unauthorized access occurred between May 22 and September 18, 2026.
- ETS discovered the breach on September 25, 2026.
- State officials began notifying families on October 16, 2026.
Background
Recent high-profile data breaches have highlighted vulnerabilities in large-scale data repositories. In September 2026, a breach at the Defense Manpower Data Center exposed unencrypted data of millions of military personnel, while another incident involving IDScan.net exposed 153 million driver's licenses. These events underscore ongoing concerns about data security in both government and private sectors. The current incident adds to a pattern of significant data exposures affecting large populations in the United States.
Why it matters
The breach compromises sensitive personal and educational data for a massive number of minors, raising significant privacy and security concerns. The exposure of disability status and demographic data could lead to targeted fraud or discrimination. The delay in discovery and notification highlights potential gaps in cybersecurity monitoring and incident response within educational infrastructure. This incident may prompt increased scrutiny of data handling practices by non-profit organizations contracted by state governments.
What to watch
Law enforcement will continue its investigation into the breach. ETS and the CDE will likely implement further security measures to prevent future incidents. Affected families may receive additional guidance on protecting their personal information. There may be calls for legislative or regulatory changes to improve data security standards for educational testing organizations.
Want the full story? Read the original reporting
Read on Politico