Cyberattack Exposes Personal Data of Millions of California Students

A cyberattack targeting the systems of a nonprofit contractor working with the California Department of Education in the United States has resulted in the theft of personal information belonging to millions of students.

Last Friday, the California Department of Education announced that a hacker had stolen sensitive information—including students' names, dates of birth, home addresses and disability status—covering all students registered during the previous three academic years.

During the 2025–2026 academic year alone, more than 5.75 million students were enrolled in educational institutions across California.

How the Breach Occurred and the Contractor's Role

The nonprofit organisation involved in the data breach is Educational Testing Service (ETS). The organisation is responsible for administering various state-level examinations in California, including assessments of students' English-language proficiency.

The security breach was first detected in late September at a secure file transfer site.

A subsequent investigation revealed that an unauthorised party had accessed the site using stolen login credentials at some point between May 22 and September 18 this year. The attacker then copied files containing personal information about California students.

Security Measures and Current Situation

Fortunately, the hackers did not obtain students' Social Security numbers or sensitive financial information. So far, there has also been no evidence that the stolen data has been publicly disseminated.

The contractor has begun formally notifying affected students and their families about the incident.

To address security weaknesses and prevent similar incidents, the organisation has implemented several urgent measures, including strengthening data monitoring, tightening access controls and introducing additional security reviews conducted by third parties.

//DBTech/BMT/OR//