California’s Department of Education is warning public school students that a contractor, Educational Testing Service, suffered a months-long data breach. ETS manages the state’s CAASPP and ELPAC assessments, and hackers copied student information through a secure file transfer protocol site between May 22 and September 18. The state says the affected data covers current and former students enrolled in California public schools from 2023 through the current school year, as well as students who left a California school since 2006 without confirming a transfer to another school.
The stolen information includes student names, dates of birth, residential addresses, schools, districts, grade levels, student identifiers, gender, race or ethnicity, primary language, country of origin, English learner status, disability and Section 504 status, testing accommodations, and program eligibility. It also includes English language proficiency information and statewide assessment registration, participation, and results where applicable. California public schools enrolled more than 5.7 million students in the 2025 school year.
ETS discovered the breach on September 25, disabled the compromised account, took the site offline, and built a new platform. The state began notifying families on October 16 and will continue through November. California’s Department of Education says ETS worked with law enforcement and cybersecurity experts and that regular web monitoring has not found evidence the information was made public, though the department declined to explain the specific steps taken. No hacking group had claimed responsibility as of Tuesday.