Hackers stole the data — including the names, addresses and disability records — of millions of current and former California public school students who took state-mandated standardized tests that evaluate their academic skills each year, education officials said Friday.
The compromised information affects far more than the state’s current 5.7 million public school students, as the breach dates back to 2023 enrollment. Students who left California but did not confirm their transfer to another school were also affected, dating back to 2006.
The data breach involved Educational Testing Service or ETS, which provides many services to California.
While the first public notice took place on Friday, school district leaders were notified on October 2.
State education officials are “urgently working with a team of state agencies to investigate and determine the scope and impact of the incident, including what information may have been affected,” according to a letter from the state’s deputy superintendent. Marie kindly.
ETS, a nonprofit testing organization, helps manage and provide testing-related services for students enrolled in California public schools, including the required Smarter Balanced tests administered in the spring. In this role, ETS maintains student demographics, test participation, and evaluations.
Exposed information also includes the student’s grade level, date of birth, and the school and district the students attend. The hackers also gained access to students’ unique ID numbers as well as information on gender, race or ethnicity, primary language, country of origin, and English learner status. Information about students’ disabilities and their eligibility status for federal programs, such as those available to help students from low-income families, was also exposed.
The stolen data did not include social security numbers, driver’s license numbers, passport numbers, financial account information, credit or debit card information, or account passwords. Personal information of parents or guardians was also not disclosed, officials said.
ETS discovered the hack on September 25. A subsequent investigation revealed that “an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026,” according to information released by the California Department of Education.
No proof yet that the information made public
Authorities said they have yet to uncover any evidence that the information had been made public. But it is also true that hackers often keep information confidential while awaiting the outcome of a ransom demand.
The official press release does not specify whether such a request was made.
A cybersecurity expert expressed concern that such a large breach could have occurred based on a compromised username and password.
“A stolen login credential should not become a passport valid for months to access the personal records of millions of students,” said Anton Dahbura, executive director of the Information Security Institute at Johns Hopkins University. “If this is what happened here, the critical question is why authentication safeguards, access restrictions and monitoring systems failed to detect and stop the unauthorized activity. »
He added: “Incidents like this reveal a fundamental weakness in how we manage student data: School systems can outsource the storage and processing of sensitive information, but they cannot outsource the consequences of a breach. When millions of student records are concentrated at a single vendor, a security failure can become a statewide problem with consequences that follow children for years.”
An ETS spokesperson defended the organization’s practices.
“ETS maintains a comprehensive information security program that is regularly evaluated by third parties,” said Christine Betaneli. “We continually invest in protecting the systems and data we store. »
Betaneli said no other “ETS customers” were affected.
“We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and greater third-party review of our security practices,” Betaneli added.
Damage Monitoring
Affected former students, including those who are now adults, are eligible for 24 months of free identity protection services and identity restoration assistance in the event of identity theft.
Officials said parents and guardians might consider requesting a free credit freeze for their children under 16 to prevent unauthorized accounts from being opened in their children’s names.
“Be wary of unexpected emails, phone calls or text messages” related to the incident, including claims that the caller is from ETS, the state or a credit monitoring company, officials also warned.
“Do not provide social security numbers, passwords, financial information, or other sensitive personal information in response to unsolicited requests.”
Additional information and updates are available on the CDE Educational Testing Service Incidents web page.
Other Notable Educational Hacks
In May, a massive cyberattack wreaked havoc on California universities after hackers breached the company behind Canvas, one of the nation’s most widely used education technology platforms, where reading assignments are posted, tests are taken and students chat with teachers.
The breach caused the company Instructure to temporarily take Canvas offline and interrupt classes, assignments and final preparations for hundreds of thousands of students and professors, with hackers threatening to leak their personal data.
A hacker group called ShinyHunters claimed responsibility for the attack. Instructure ultimately announced that it had reached an agreement with the “unauthorized actor involved” to return the compromised data, but did not specify who that actor was or whether any payment was involved. He said he had obtained proof that copies of the data had been destroyed, but acknowledged there was no way to be sure.
The most high-profile hack of a local school district was the cyberattack on Los Angeles Unified over Labor Day weekend in 2022.
District officials took the unprecedented step of shutting down all of the district’s computer systems to limit the damage. The school opened as scheduled Tuesday, but students, families and staff had to reset more than 600,000 passwords. Many said a full week of instruction was lost and technicians discovered “digital tripwires” left behind to further infect systems. The most severe damage was in the facilities division, where about half of the servers were encrypted, meaning district staff couldn’t access their own systems and records.
The district confirmed a ransom demand but refused to pay.
The district initially minimized the damage caused by the compromised information. Superintendent. Alberto Carvalho said there was “no evidence of widespread impact” and called those affected “outliers”.
But a review of leaked records by The Times revealed a psychological evaluation of a student from 2005, despite the district’s denials that such records had been disclosed. The investigation also found employee disciplinary records, a worker’s criminal history report, contractor payroll data, tax forms and passports. And a subsequent district filing with the state acknowledged that more than 500 people who worked for district contractors likely had their Social Security numbers and other confidential information exposed. The district also later reported that about 2,000 student evaluation records had been released, including those of 60 current students.
Gn usa
