California School Data Breach May Affect Up to 17 Million Students
California school data breach may affect up to 17 million students, Malwarebytes reports.
The breach occurred in a Secure File Transfer Protocol system used by the nonprofit Educational Testing Service, or ETS, which the department uses to manage student information. Malwarebytes reported that the attackers were able to regain entry repeatedly over four months and accessed student files containing names, home addresses, dates of birth and other data.
ETS has not officially disclosed how many students were affected. Malwarebytes noted that California public schools counted more than 5.7 million students in the 2025-2026 school year alone, and the California Department of Education believes students who enrolled in the previous three years could be affected — around 17 million students if all three years were equal.
The files were accessed and copied multiple times between May 22 and September 18, according to the report. The activity was discovered on September 25. Malwarebytes said the attackers are believed to have gained access through compromised credentials rather than a software vulnerability, though the specific attack vector has not been shared. The report described the access as appearing to stem from a simple password theft.
ETS and the California Department of Education are working to notify affected individuals, who are being offered 24 months of identity protection software for free. The report said no evidence has been found to show that the stolen information has been publicly released, and no ransom threat appears to have been made.
ETS said it had implemented additional safeguards, including enhanced monitoring, strengthened access controls and further third-party review of its security practices.
Editor's Summary
The breach at an ETS file-transfer system exposed student names, addresses and birth dates, with up to about 17 million students potentially affected across three years. ETS and California education officials are notifying affected individuals and offering identity protection. No evidence of public release or a ransom threat has been reported.