Oct 16 (Reuters) – The California Department of Education said on Friday a hacker accessed the data of millions of students, including names, birth dates, addresses and disability status, by exploiting the system of a non-profit contractor that works with the state.
The hacker accessed the data of “all students enrolled in the three previous school years,” the department said. More than 5.7 million students were enrolled in California during the 2025-2026 school year, according to the department.
The non-profit, Educational Testing Service, on Friday began notifying students and their families of the breach, which was identified late last month but found to have been ongoing since May, the education department said.
The non-profit identified the breach involving a secure file transfer protocol site on September 25 and began an investigation, according to the California agency.
“The investigation determined that an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026,” the education department said.
Educational Testing Service has not found that any of the information has been made public so far, the education department said, adding that Social Security numbers and sensitive financial information were not accessed.
In an October 2 letter to county and district school officials, the California agency said the testing service had stopped “normal enrollment data processing.”
“The CDE is actively working to minimize disruption and resume affected assessment activities in a timely manner,” the department said.
In California, Educational Testing Service administers statewide assessments including those for English language proficiency.
“We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices,” Educational Testing Service said in a statement to Reuters. “Our priority remains the students, families and educators we serve and safeguarding the assessment programs we deliver for our clients and partners globally.”
(Reporting by Christian Martinez; Editing by Sergio Non and Sam Holmes)
