California Announces Massive Data Breach Affecting 7 Million Students via ETS

Key points

• The breach affected approximately 7 million students enrolled in California public schools over the past three years, with some records dating back to 2006.
• Educational Testing Service (ETS) discovered the unauthorized access on September 25, 2026, after an investigation revealed activity between May 22 and September 18.
• Compromised data includes names, addresses, dates of birth, grade levels, unique student identifiers, and disability information.
• Social Security numbers, driver's license numbers, and financial account information were not part of the breach.
• Affected individuals are eligible for 24 months of free identity protection services through Experian IdentityWorks.
• State officials warned families to be cautious of phishing attempts related to the incident.

Background

This incident follows a significant cyberattack on the Canvas learning platform in May 2026, which disrupted classes for hundreds of thousands of students across California. The 2026-2027 school year began with heightened security concerns in the education sector. Previous breaches, such as the 2022 attack on Los Angeles Unified School District, highlighted vulnerabilities in school IT systems, though this incident involves a centralized testing vendor rather than a local district.

How outlets are covering it

The Los Angeles Times and New York Post emphasize the scale of the breach, noting that it affects not just current students but former students who left the state, with records dating back to 2006. Politico and Reuters focus on the operational response, highlighting that ETS halted normal enrollment data processing and paused certain testing activities while security was assessed. The Los Angeles Times includes criticism from cybersecurity expert Anton Dahbura, who questioned how a single compromised credential could allow months-long access without detection, suggesting fundamental weaknesses in authentication safeguards. ETS spokesperson Christine Betaneli defended the organization, stating that no other clients were affected and that enhanced monitoring and third-party reviews have been implemented. All sources agree that no evidence of public data release has been found yet, though ransom demands remain a possibility.

Why it matters

This breach exposes the vulnerability of centralized data storage in education, where a single security failure at a vendor can impact millions of students across a state. It raises concerns about the long-term consequences for students' privacy and identity security, as well as the adequacy of current authentication and monitoring systems in protecting sensitive demographic and disability information. The incident may lead to increased scrutiny of data handling practices by educational contractors and potentially new state regulations regarding student data security.

What to watch

State officials and ETS will continue to investigate the scope and impact of the breach, including determining if any data was made public or if ransom demands were made. Affected families are expected to receive further notifications and guidance on protecting their information. ETS will implement additional safeguards, including enhanced monitoring and strengthened access controls, as part of its response. Law enforcement is conducting an investigation into the unauthorized access. Parents are advised to monitor for phishing attempts and consider credit freezes for children under 16.