# Major Breach Exposes Data of Millions of California Students A recent cyberattack targeting **Educational Testing Service (ETS)**, a contractor for the **California Department of Education (CDE)**, has compromised a vast trove of sensitive data belonging to children enrolled in California public schools over the past three years. ## The Scope of the Breach The **CDE** issued multiple statements over the last week, alerting students and families that **ETS** experienced a months-long data breach. The compromised information is extensive, encompassing: * Student names, dates of birth, residential addresses, schools, districts, and grade levels. * Statewide Student Identifiers (**SSID**) and local student identifiers. * Gender, race or ethnicity, primary language, country of origin, and English learner status. * Disability and Section 504 status, testing accommodations, and primary disability type. * Eligibility status for programs such as Title I, Part A; Title I, Part C; McKinney-Vento; and Military Connected Student. * English language proficiency information and statewide assessment registration, participation, and results, where applicable. This incident affects current and former students enrolled in California public schools between 2023 and the current school year, as well as students who left a California school since 2006 and did not confirm transfer with the **CDE**. ## **ETS**'s Role and Response **ETS** is responsible for providing testing services to California K-12 public schools, which served over 5.7 million students in the 2025 school year. They manage critical exams like the **California Assessment of Student Performance and Progress (CAASPP)** and the **English Language Proficiency Assessments for California (ELPAC)**. According to **ETS**, hackers exfiltrated student information via a secure file transfer protocol site between May 22 and September 18 of this year. Upon discovering the breach on September 25, **ETS** promptly disabled the compromised account, took the entire site offline, and subsequently built an entirely new platform. ## Mitigation Efforts and Ongoing Investigation “After working with law enforcement and cybersecurity experts, **ETS** has taken steps to reduce the potential risk of the data being made publicly accessible,” the **CDE** stated. They added that, to date, regular web monitoring has not uncovered any evidence of the information being made public. However, a **CDE** spokesperson declined to elaborate on the specific steps taken to mitigate public access risks. As of Tuesday, no specific hacking group has claimed responsibility for the attack. The state began notifying affected families on October 16, with notices expected to continue through November. The **CDE** is collaborating with state cybersecurity experts and other agencies to assess the incident's impact on California students. They are also reviewing **ETS**'s compliance with applicable data security and contractual requirements. **ETS** has temporarily halted normal enrollment data processing and paused certain testing activities while their systems' security is assessed and the investigation continues, with the **CDE** working to minimize disruption and resume testing as soon as possible. ## A Broader Trend in Education Sector Attacks This incident is not isolated. Educational service providers like **ETS** have become frequent targets for cybercriminals. Previous attacks have impacted major companies such as **PowerSchool**, **Instructure**, **Illuminate Education**, **McGraw Hill**, and **Kaplan**, underscoring a pervasive vulnerability across the educational technology landscape.