Educational Testing Service, the nonprofit that administers California's mandated Smarter Balanced assessments, discovered unauthorized activity on Sept. 25, 2026 involving an SFTP site used to exchange statewide assessment data with the California Department of Education.

According to the CDE, an unauthorized party used a compromised login credential at various times between May 22 and Sept. 18, 2026 to access the site and copy files containing California student information.

ETS disabled the account, took the SFTP site offline, and launched an investigation with external cybersecurity experts.

The stolen data includes names, addresses, dates of birth, grade level, unique state student identifiers, gender, race and ethnicity, primary language, country of origin, English learner status, disability information, and eligibility for federal programs such as aid for low-income students.

The L.A. Times reports the breach reaches back to 2006 enrollments, catching former students who left California without confirming a transfer to another school.

Officials said Social Security numbers, driver's license and passport numbers, financial account data, passwords, and parent or guardian information were not taken.

The most unsettling detail is the attack vector: a single compromised username and password allegedly sustained months of access. Johns Hopkins Information Security Institute executive director Anton Dahbura told the L.A.

Times that 'a stolen login credential should not become a months-long passport to millions of students' personal records,' and asked why authentication safeguards, access restrictions, and monitoring failed to detect the activity.

He noted that schools can outsource storage and processing of sensitive data but cannot outsource the consequences of a breach.

The New York Post reports hackers stole personal information on roughly 7 million current and former California public school students, covering everyone enrolled over the past three years. The L.A.

Times frames the affected population as far larger than the state's current 5.7 million public-school students because the compromised files date back to 2023 enrollments and beyond.

Officials have found no evidence the information has been made public, but the L.A. Times notes hackers often withhold stolen data pending a ransom demand, and the state's release did not say whether one has been made.

The incident lands in a bad stretch for education vendors: GovTech reports Frontline Education informed districts that a breach of its Central and School Health Management products potentially exposed addresses, emails, and Social Security numbers of school employees nationwide, including 1,610 staff in Methuen, Pennsylvania.

When millions of records concentrate with a single vendor, one failure becomes a statewide problem.

ETS paused normal enrollment data processing and certain testing activities while it assesses system security, according to a CDE letter cited by the New York Post.

Everyone affected, including adults who were students years ago, is eligible for 24 months of free identity-protection and restoration services through Experian IdentityWorks.

Officials urge parents of children under 16 to consider a free credit freeze and warn families to ignore unsolicited calls or emails claiming to come from ETS or the state, never sharing Social Security numbers or passwords in response.