A single stolen login let an outsider copy California student records from a state testing contractor’s file site, reaching back three school years, officials say.
Story Snapshot
- Investigators say a compromised account accessed and copied files between May 22 and September 18, 2026.
- Data may include names, student identifiers, birth dates, addresses, demographics, disability and program details, and test results.
- Social Security numbers, financial data, passwords, and parent or guardian data were not involved, according to the state.
- Rough estimates from media place the impacted population in the millions across the last three school years.
What Officials Confirm About the Breach
The California Department of Education and Educational Testing Service reported that an outsider used a compromised login to reach a secure file transfer site that holds statewide testing data. Educational Testing Service identified unusual activity on September 25, 2026, and investigators found access occurred at various times from May 22 through September 18, 2026. Educational Testing Service disabled the account, took the site offline, and began an investigation with outside cybersecurity experts while coordinating notices to students and families.
State notices say the copied information concerns California students, including those enrolled during the previous three school years. The data may include names, Statewide Student Identifiers, dates of birth, addresses, demographic details, disability and program-participation information, and statewide assessment information. Officials say Social Security numbers, financial-account information, passwords, and parent or guardian information were not involved in the incident. Politico reported that the number of students linked to the exposed data reaches into the millions statewide.
How One Vendor Account Became a Statewide Problem
The breach underscores how one weak point at a contractor can ripple across an entire state school system. California relies on Educational Testing Service to manage statewide assessment data, so a single stolen credential opened a door to many districts’ records at once. That pattern fits a national shift, where vendor-related incidents have climbed as schools centralize data and tools with third parties. Reports show about half of United States school districts saw a cybersecurity incident in 2025, with vendor cases rising sharply.
Families want to know what was taken and how it might be misused. Student names, addresses, and birth dates can fuel fraud or targeted phishing, even when Social Security numbers and bank data are not exposed. The California Department of Education says Educational Testing Service is notifying affected students and families, which is a key step to help them watch for fake emails, phone scams, and account takeover attempts. Officials have not publicly identified the attacker or confirmed any sale or posting of the files.
Accountability, Timelines, and What Comes Next
Educational Testing Service said it found the activity on September 25, a week after the last reported access date of September 18, raising fair questions about monitoring speed and alerting across vendor systems. The state’s statements confirm copying of files but do not provide a file-by-file count or a precise number of affected students. Independent reporting places the likely scale in the millions, given three years of statewide enrollment and testing coverage. Officials report that law enforcement and external experts are involved in the review.
California officials have announced a student data breach involving a statewide testing contractor. Affected families are being notified and offered free identity-protection services.https://t.co/HwCOYVxBal
— OCDE (@OCDeptofEd) October 20, 2026
For parents and students, basic steps can reduce risk now. Use strong, unique passwords for school portals and email. Turn on multi-factor authentication where it is offered. Be careful with links and attachments in emails or texts that reference school records or test scores. Watch mail for notice letters from Educational Testing Service, and consider a fraud alert if you see unusual activity. Families can also ask districts what data they share with vendors and how those vendors secure it.
Sources:
zerohedge.com, cde.ca.gov, politico.com, stingrai.io
