California warns all public school students of data stolen in contractor breach
The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.
A massive data breach has exposed sensitive personal information for millions of California students, including their names, Social Security IDs, home addresses, and more. The attack targeted a third-party partner, Educational Testing Service (ETS), which handles student data for the California Department of Education. The breach occurred due to compromised credentials, as no software vulnerabilities were identified.
The attackers gained repeated access over a period of four months, stealing files between May 22 and September 18, 2025. California's public school system accommodated over 5.7 million students in the 2025-2026 academic year alone, indicating that potentially around 17 million students may be affected. The breach was discovered on September 25, 2025, following its initial detection.
The California Department of Education and ETS are working to notify impacted individuals and provide them with 24 months of free identity protection software. Neither the stolen data nor a ransom demand has been publicly confirmed. In response to the incident, ETS has implemented additional security measures, such as enhanced monitoring, stronger access controls, and a review of their security practices by third-party experts.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
