Hackers stole personal information from 7 million California public school students as part of a massive breach, authorities announced Friday.
The information was accessed from a nonprofit that has a contract with the state Department of Education, Politico reported.
The information stolen includes students’ names, demographic information and disability status. The hack affected all students enrolled in the state public schools over the past three years.
The Education Testing Service (ETS) –– a nonprofit organization that administers standardized testing for California K-12 public schools –– was specifically targeted.
ETS manages California’s statewide assessments such as the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).
“On September 25, 2026, ETS identified unauthorized activity involving an SFTP site used to exchange California statewide assessment information with CDE,” the California Department of Education (CDE) said.
“ETS disabled the account involved, took the affected SFTP site offline, and initiated an investigation with the assistance of external cybersecurity experts. The investigation determined that an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026 to access the SFTP site to copy files containing California student information,” CDE added on.
