California warns all public school students of data stolen in contractor breach

A cyberattack on a contractor for California’s Department of Education (CDE) exposed troves of sensitive information covering all children enrolled in public schools over the last three years.

The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.

The student information copied by hackers includes:

• Student names, dates of birth, residential addresses, schools, districts, and grade levels;
• Statewide Student Identifiers (SSID) and local student identifiers;
• Gender, race or ethnicity, primary language, country of origin, and English learner status;
• Disability and Section 504 status, testing accommodations, and primary disability type;
• Eligibility status for the following programs: Title I, Part A; Title I, Part C; McKinney-Vento; and Military Connected Student; and/or
• English language proficiency information and statewide assessment registration, participation, and results, where applicable.

Those affected include current and former students enrolled in California public schools between 2023 and the current school year, as well as students who left a California school since 2006 and did not confirm transfer to another school with the CDE.

CDE hired ETS to provide testing to California K-12 public schools, which enrolled more than 5.7 million students in the 2025 school year. ETS manages the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC) exams given each year. 

ETS, which did not respond to requests for comment, said in a release that hackers copied student information through a secure file transfer protocol site this year from May 22 to September 18. 

After discovering the breach on September 25, ETS initially disabled the account used to steal the information and eventually took the entire site offline before building an entirely new platform in response to the hack. 

“After working with law enforcement and cybersecurity experts, ETS has taken steps to reduce the potential risk of the data being made publicly accessible,” CDE said. “Furthermore, ETS, following regular web monitoring, has, to date, not uncovered any evidence that the information has been made public.”

A spokesperson for CDE declined to explain what steps ETS took to reduce the risk of the data being made publicly accessible. The ETS statement claims it worked with “law enforcement as well as with cybersecurity experts” to reduce the risk of the incident. 

No hacking group has said it was responsible for the attack as of Tuesday. 

The state began notifying families of the incident on October 16 and said it will continue to distribute notices of the attack through November. 

CDE said it is working with state cybersecurity experts and other agencies to assess how the incident will impact California students. They are also “reviewing… ETS’s compliance with applicable data security and contractual requirements.”

ETS said it has “halted normal enrollment data processing and paused certain testing activities while the security of its systems are assessed, and the investigation continues.” CDE explained that it is working to minimize the disruption and resume the affected testing as soon as possible. 

Educational service providers like ETS have been repeatedly targeted by cybercriminals – with multiple incidents impacting large companies like PowerSchool, Instructure, Illuminate Education, McGraw Hill, Kaplan and more.