One Stolen Login Exposed Millions of Student Records

Schools collect an extraordinary amount of information about students.

Names.

Addresses.

Test results.

Language status.

Disability information.

Program participation.

Now millions of California students are being notified that some of that information was stolen.

And the breach appears to have started with something remarkably ordinary:

a compromised login.

Hackers used stolen credentials to access a file-transfer system operated by Educational Testing Service, better known as ETS, which runs parts of California's statewide testing programme.

The attackers were able to access and copy student files repeatedly between May 22 and September 18, 2026.

ETS discovered the unauthorized activity on September 25.

Read the California Department of Education notice

What information was stolen?

The exact information varies by student.

But California officials say the stolen files may contain:

• names
• dates of birth
• home addresses
• schools and districts
• grade levels
• statewide student ID numbers
• gender
• race or ethnicity
• primary language
• country of origin
• English learner status
• disability status
• testing accommodations
• participation in certain education programmes
• statewide assessment information and results

That is much more than a list of email addresses.

For some students, the files contain deeply personal information about their education and disability status.

What was not exposed?

Officials say the breach did not involve:

• Social Security numbers
• financial account information
• passwords
• parent or guardian information

ETS also says it has not found evidence so far that the stolen information has been publicly released.

That is reassuring.

But it does not make the breach minor.

The information involved could still be useful for highly convincing phishing or impersonation attempts.

How many students are affected?

California says the affected information includes, but is not limited to, students enrolled during the previous three school years.

More than 5.7 million students were enrolled in California public schools during the 2025–26 school year alone.

The breach may also involve records belonging to some former students.

So the number of people potentially affected runs into the millions.

The hackers had access for months

This may be the most uncomfortable detail.

According to the investigation, the compromised account was used at various times from May 22 until September 18.

That means the intrusion was not a single moment.

Files could be copied repeatedly over a period of almost four months.

ETS discovered the activity on September 25 and then:

• disabled the affected account
• took the file-transfer site offline
• brought in cybersecurity experts
• built a replacement system with additional security controls

The company is also providing affected students with two years of free identity-protection services.

The school itself did not need to be hacked

This is what makes the story especially relevant to education.

A school district can:

• secure its network
• train its staff
• require strong passwords
• patch its systems
• monitor suspicious activity

and still have student information exposed somewhere else.

Schools depend on outside companies for:

• testing
• learning platforms
• attendance
• grading
• communication
• payments
• special education
• analytics
• AI tools

Every additional service can become another place where student information is stored.

The security of the school is therefore only part of the security of the student.

One login can become a very big problem

There is also something strikingly ordinary about the apparent entry point.

This was not described as an exotic attack on some previously unknown technical vulnerability.

Officials say the attacker used compromised login credentials.

That could happen because of:

• phishing
• password reuse
• stolen credentials
• malware
• poor account security

We do not yet know exactly how the credentials were compromised.

But the incident demonstrates why access controls matter so much.

When one account can reach millions of sensitive records, protecting that account becomes critical.

Student data can remain sensitive for years

Adults affected by a data breach can change a password or cancel a credit card.

Children have fewer options.

Their:

• date of birth
• education history
• demographic information
• disability status

do not simply change after a breach.

And because children may not use financial products for years, identity misuse can sometimes remain unnoticed for a long time.

That is why affected families are being offered identity monitoring and are being advised to remain alert for suspicious messages.

Testing requires a surprising amount of data

Standardized testing can look fairly simple from a student's perspective.

Sit down.

Take the test.

Receive a score.

Behind the scenes, however, testing systems may need to connect results with:

• student identity
• school
• grade
• language needs
• disability accommodations
• programme eligibility

That creates very valuable datasets.

And once those datasets exist, somebody has to protect them.

The bigger EdTech lesson

Schools increasingly ask technology companies questions such as:

Does your product work?

How much does it cost?

Can teachers use it easily?

But perhaps there should be another set of questions:

Exactly what student data do you store?

Why do you need it?

How long do you keep it?

Which employees and systems can access it?

What happens if one account is compromised?

Can we delete the data when we leave?

Those questions are not as exciting as AI features or interactive dashboards.

But this breach shows why they matter.

Millions of students did not lose their information because they clicked something dangerous.

Their data was already sitting in a system they were required to use.

And one compromised login was enough to put it at risk.

Sources

California Department of Education: ETS Begins Notifying California Students and Families Following Data Security Incident

California Department of Education: ETS Incident Information

Reuters: Hacker gets data on millions of California students