Hackers Used Stolen Logins to Copy Disability Records of 5 Million CA Students
Hackers used stolen credentials to access an ETS file server, copying data for over five million current and former public school students in California.
Key points
- Attackers accessed a secure ETS server using compromised login details between May 22 and September 18.
- Stolen files contain disability records and standardized test scores for millions of California students.
- Social Security numbers, financial data, and passwords were not included in the breach.
Educational Testing Service (ETS) has begun notifying families after attackers stole sensitive education records belonging to millions of California public school students. The California Department of Education confirmed that an unauthorized party accessed a secure file transfer protocol site operated by ETS, a nonprofit contractor that administers standardized tests for the state.
The intruders used compromised login credentials to gain entry to the system. According to the investigation, the attackers copied files containing student information at various times between May 22 and September 18. ETS stated that there is currently no evidence the stolen data has been made public or distributed further.
Scope of the data exposure
The breach affects all students enrolled in California public schools during the previous three academic years, though the impact may extend beyond that specific group. The California Department of Education reported that over 5.7 million students were enrolled in the 2025–2026 school year alone. Not every affected individual had every category of data exposed, but the files contained more than just basic contact information.
The stolen records include statewide assessment details, such as test scores, and information regarding disability status and program participation. These documents reveal highly personal aspects of a student’s educational history and health accommodations. The breach does not involve Social Security numbers, financial account details, passwords, or parent and guardian information.
Who is affected and next steps
ETS is distributing breach notices at the direction of the California Department of Education to help affected individuals understand the incident. The department is assisting in the distribution of these notifications to ensure reach. Students and parents are advised to verify any communication regarding the incident through official channels rather than responding to unsolicited messages.
ETS is offering two years of free identity-protection services to those affected. Parents or legal guardians can enroll affected minors, while adults can enroll themselves. Affected parties should check the notification instructions for the appropriate age group eligibility. Users are warned to watch for phishing attempts that use details about a child or their school to sound convincing.
What should you do?
Monitor official communications from the California Department of Education and ETS for verified updates on the breach. Do not share passwords, security codes, or payment details in response to unsolicited emails or calls that reference this incident. Review the provided breach notice carefully to determine if your specific data was exposed. Consider enrolling in the offered identity-protection services if you are an affected student or parent.
What to do and how to stay safe: Educational Testing Service
- Verify any breach-related communication through official government or vendor channels before taking action.
- Monitor financial and credit accounts for unusual activity, even though financial data was not stolen.
- Enroll in the free identity-protection services offered by ETS if you are an affected individual.
- Watch for phishing attempts that use personal education details to trick you into sharing credentials.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Was financial information or Social Security numbers stolen in the ETS breach?
No, the California Department of Education confirmed that Social Security numbers, financial account information, and passwords were not involved.
Which students are affected by this data breach?
The breach includes all students enrolled in California public schools during the previous three school years, potentially affecting over 5.7 million individuals.
Did hackers publish the stolen data online?
ETS stated that it has found no evidence so far that the stolen information has been made public.
