Millions of California students’ sensitive data stolen in breach

Personal information belonging to millions of current and former California public school students has been stolen from a system operated by Educational Testing Service (ETS). ETS is a nonprofit organization that helps run the state’s standardized tests under contract with the California Department of Education (CDE). It has begun notifying students and families after an unauthorized party accessed and copied student information from an ETS-operated secure file transfer protocol (SFTP) site. CDE is distributing the ETS breach notice to help affected individuals receive information about the incident and available resources. An investigation determined that an unauthorized party used compromised login details to ​access the site and copy files containing California student information at various ​times between May 22 and September 18. The CDE says the breach includes all students enrolled during the previous three school years, although the affected population is not limited to that group. The information involved varies by individual but may include: Student names Statewide Student Identifiers (SSIDs) Dates of birth Home addresses Demographic information Disability and program participation information Statewide assessment information, including test scores According to the CDE, over 5.7 million students were enrolled in California ​public schools during the 2025–2026 school year alone. Not every affected student had every category of information exposed. However, this is clearly more than a list of names and email addresses: The stolen files can reveal highly personal information about a student’s education and disabilities. CDE says Social Security numbers , financial account information, passwords, and parent or guardian information were not involved. ETS says it has found no evidence so far that the stolen information has been made public. How to stay safe ETS, at CDE’s direction, is notifying affected students and families. If your information or your child’s information was involved, follow the instructions in the notification and: Verify any communication about the incident through official channels. Consider enrolling in the two years of free identity-protection services. Parents or legal guardians can enroll affected minors, while affected adults can enroll themselves. Check the instructions for the appropriate age group. Watch for messages that use details about your child or their school to sound convincing. Don’t share passwords, security codes, or payment details in response to an unsolicited message or call. For more advice, read our blog “ Involved in a data breach? Here’s what you need to know. ” Pro tip: Students, faculty, and staff at participating US universities can get free security software through the Malwarebytes Student Protection Program . Visit malwarebytes.com/student to check your eligibility and sign up. Let’s face it, an incognito window can only do so much. Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. About the author Was a Microsoft MVP in consumer security for 12 years running. Can speak four languages. Smells of rich mahogany and leather-bound books.