Contractor Breach Exposes Data of Millions of California Public School Students

A cyberattack on Educational Testing Service (ETS), a contractor for the California Department of Education (CDE), exposed sensitive information covering all children enrolled in the state's public schools over the last three years. Affected people include current and former students enrolled between 2023 and the current school year, as well as students who left a California school since 2006 and did not confirm a transfer with the CDE. California public schools enrolled more than 5.7 million students in the 2025 school year.

ETS runs the state's annual student assessment exams. It said hackers copied student information through a secure file transfer site between May 22 and September 18. ETS discovered the breach on September 25. It first disabled the account used to steal the data, then took the whole site offline and built a new platform. The CDE said ETS has found no evidence the data has been made public, though a CDE spokesperson declined to explain what steps were taken to reduce that risk. No hacking group has claimed responsibility.

The state began notifying families on October 16 and will keep sending notices through November. The CDE is working with state cybersecurity experts and other agencies to assess the impact, and is reviewing ETS's compliance with data security and contractual requirements. For businesses, the case is a reminder that data handled by suppliers carries your risk too, and that a breach can run for months before anyone notices.