Millions of California students and former students are now tied to a breach that exposed deeply personal school records, including addresses, birth dates, language status and disability-related details. The incident involves a testing contractor, a compromised login, and a data trail that stretches back years, which means people who moved away long ago may still be caught in the fallout. Families are being told to watch for notices, use the free protection being offered, and stay alert for scams that could use the stolen details as bait.
Officials say the attack hit Educational Testing Service, which works with California education officials to manage statewide assessments and related records. Someone allegedly used stolen credentials to get into a secure file transfer system and quietly copied student files over several months, from late May through mid-September 2026. The suspicious activity was discovered in late September, prompting ETS to shut down the affected account and take the system offline.
The scope of the stolen information is what makes this breach hit hard. Depending on the student, the files may include names, dates of birth, home addresses, school names, grade levels, ID numbers, race, ethnicity, primary language, disability information, testing accommodations and assessment results. Some records also touched on participation in programs for students facing homelessness or other educational challenges, while officials say Social Security numbers, financial account data and parent information were not included.
That missing financial data is a relief, but it does not make the breach harmless. A name, school and address can be enough to fuel a convincing phishing attempt, and disability-related information adds another layer of privacy risk. In the wrong hands, even school records can become a tool for impersonation, manipulation or identity theft attempts that feel surprisingly personal.
One of the most unsettling parts of the case is that the affected people may now live anywhere. California officials say the compromised records cover recent students as well as former students whose ties to state public schools go back many years, including some who left as far back as 2006. So a family that moved to another state, or an adult who graduated long ago, could still be part of the exposed group without realizing it.
California’s public school system serves roughly 5.7 million students, so even a breach limited to certain years can still involve a huge number of people. ETS says no other customers were affected, which narrows the concern to those with a California public school connection. Even so, officials have not yet released a final unique count, leaving plenty of families waiting to see whether their records were among those copied.
State education officials, the board of education and cybersecurity experts are all involved in the investigation. The California Cybersecurity Integration Center is assisting with the technical review, while officials also examine whether ETS met its security obligations under contract and state requirements. ETS says it has added stronger monitoring and tighter access controls, but investigators are still tracking whether the stolen files surface anywhere public.
Notifications began going out in mid-October 2026 and are expected to continue into early November. Families who receive a letter or email will be told what was exposed and how to access free identity-protection services, though not getting a notice does not guarantee safety if old contact information is on file. For anyone concerned, the official incident page and assistance line are the safest places to get verified information.
ETS is offering 24 months of free identity theft protection to eligible current and former students, and parents or guardians can enroll minors. Adults can sign up for themselves, and identity restoration help is also available for a limited time even if monitoring is not used. The enrollment deadline is in March 2027, and no credit card is required, which removes one more excuse to sit on the sidelines.
After a breach like this, the biggest risk is often not the stolen file itself but the scams that follow it. Fake messages can look surprisingly legit when they include a child’s school, grade or personal details, so unexpected emails and texts should be treated with caution. Families may also want to check credit files, especially for older teens and adults, because identity theft does not always announce itself loudly.
Parents can also take a harder look at what their schools and districts keep on file, who gets access to it and how long outside vendors store it. Student information tends to live far longer than most families expect, and this breach is a reminder that childhood records do not always stay in the past. The real pressure now is on schools, contractors and state officials to explain why so much sensitive information was still sitting around in the first place.
