California Student Data Breach at ETS Exposes Millions of Records
ETS breach exposed names, birth dates and addresses of millions of California public school students.
The breach affects students who took the state’s mandated standardized tests, which annually assess academic proficiency, the report said. It reaches beyond California’s current 5.7 million public-school students: the compromised data dates back to 2023 enrollments, and also includes students who left California but did not confirm their transfer to another school, with records going back to 2006. ETS provides extensive services to California, including test participation and assessment data, according to the report.
A web page about the incident from the California Department of Education said the breach involved a compromised login credential. The credential was then used to copy files containing student information at “various” times between May 22 and September 18, 2026, according to the report.
“A stolen login credential should not become a months-long passport to millions of students’ personal records,” said Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute. “If that is what happened here, the critical question is why authentication safeguards, access restrictions, and monitoring systems failed to detect and stop the unauthorized activity.” Dahbura added that school systems may outsource the storage and processing of sensitive information, but they cannot outsource the consequences of a breach, and that concentrating millions of student records with a single vendor can turn one security failure into a statewide problem.
Affected former students, including those who are now adults, are eligible for 24 months of free identity-protection services and identity-restoration help if there is identity theft, according to the report. Officials said parents and guardians may want to consider requesting a free credit freeze for their children who are under 16 to help prevent unauthorized accounts from being opened in the children’s names.
An ETS spokesperson told the Times that the organization has now implemented additional safeguards, including strengthened access controls, enhanced monitoring and more third-party review of its security practices.