An unauthorized party used a compromised login credential to enter an Educational Testing Service-operated secure file transfer site and copy files at various times between May 22 and September 18, 2026.

ETS, the nonprofit contractor that supports California's CAASPP academic assessments and ELPAC English proficiency tests, identified the activity on September 25, disabled the account involved, took the site offline and opened an investigation with outside specialists.

The surprising element is scope and sensitivity rather than a confirmed count. California has not published any deduplicated accounting of records or people affected, but reports describe the incident as touching millions of students.

A Reuters report carried by The Daily Star cited California enrollment exceeding 5.7 million in the 2025-26 school year as context for the potential scale.

The accessed files may reach students enrolled during the previous three school years, plus some former students who left California schools since 2006.

The data fields vary by individual.

California's notice lists names, dates of birth, addresses, school and grade information, state and local student identifiers, demographic details, program-participation records and statewide assessment information, along with English-learner status, disability and Section 504 status, testing accommodations and eligibility for programs such as Title I and McKinney-Vento.

The state says Social Security numbers, driver's license and passport numbers, financial and payment-card data, passwords and parent or guardian information were not involved.

ETS says that, following regular web monitoring, it has so far found no evidence that the copied information has been made public. California treats that as a finding about what monitoring has detected, not a guarantee the files cannot later be misused.

The state says ETS has built a replacement file transfer site with enhanced security controls, halted normal enrollment data processing and paused certain testing activities while its systems were assessed, in an October 2 letter to school leaders.

The incident puts renewed attention on vendors that sit between schools and statewide systems. Districts such as Pasadena Unified, which says it is assessing any potential local impact, rely on ETS to move assessment data among districts, state agencies and contractors.

Even without financial data, a name, birth date, address and persistent student identifiers assembled alongside disability and academic records can support targeted phishing and impersonation of families. Encryption in transit did not help because the intruder held a valid credential.

ETS began notifying affected students and families on October 16, with mailings expected to continue into early November.

The company is offering two years of Experian IdentityWorks identity protection at no cost; Pasadena Now reports a March 19, 2027 enrollment deadline for students under 18 and March 19, 2029 for adults.

California's Department of Education and State Board of Education are reviewing the incident and ETS's compliance with data security and contractual requirements, while district leaders await the full accounting.