California's Department of Education (CDE) has begun notifying families that assessment contractor Educational Testing Service (ETS) suffered a months-long breach in which hackers copied sensitive student records through a secure file transfer protocol site between 22 May and 18 September 2026. The data covers essentially every child enrolled in California public schools over the past three years — names, dates of birth, residential addresses, schools, districts and grade levels, statewide and local student identifiers, gender, race or ethnicity, primary language and country of origin, English-learner status, disability and Section 504 status, testing accommodations, Title I and McKinney-Vento eligibility, and assessment registration, participation and results — plus students who left a California school since 2006 without a confirmed transfer. ETS, which runs the CAASPP and ELPAC exams for a system that enrolled more than 5.7 million students in the 2025 school year, discovered the breach on 25 September, disabled the abused account, took the site offline and rebuilt the platform, and has paused normal enrolment data processing and some testing while systems are assessed. No hacking group had claimed responsibility as of 20 October. It is the broadest exposure of K-12 pupil data disclosed this year.

• Source article