The California Department of Education disclosed the breach on Friday, saying the unauthorised party accessed records belonging to students enrolled during the three preceding school years.
The compromised information included students’ names, dates of birth, home addresses and disability status. More than 5.7 million students were enrolled in California schools during the 2025–2026 academic year, according to the department.
However, the agency said Social Security numbers and sensitive financial information were not accessed. It also noted that investigators had not found evidence that the compromised information had been made public.
Educational Testing Service (ETS), the non-profit organisation involved in the incident, began notifying affected students and their families on Friday. The breach was identified late last month, although investigators determined that the unauthorised access had been taking place since May.
According to the California Department of Education, ETS identified the security incident involving a secure file transfer protocol site on September 25 and subsequently launched an investigation.
“The investigation determined that an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026,” the department said.
The incident has also disrupted some of the contractor’s operations. In a letter dated October 2 to county and district school officials, the department disclosed that ETS had suspended “normal enrollment data processing.”
The state agency said it was working to limit the disruption and restore affected services, particularly assessment activities that depend on the organisation’s systems.
“The CDE is actively working to minimize disruption and resume affected assessment activities in a timely manner,” the department said.
ETS plays a significant role in California’s education system, administering statewide assessments, including tests designed to measure English language proficiency. The breach therefore presents challenges not only for the protection of student information but also for the continuity of assessment-related services.
In response to the incident, ETS said it had introduced additional security measures to prevent further unauthorised access and strengthen its systems.
“We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices,” the organisation said in a statement to Reuters.
It added that protecting students, families and educators remained its priority, alongside securing the assessment programmes it delivers for clients and partners around the world.
The incident underscores the risks associated with the handling of sensitive personal information by third-party service providers, particularly those entrusted with large volumes of student records. The investigation and ongoing notifications are expected to help affected families understand the scope of the breach and the potential implications for their information.