One year ago, Congress defunded public media. Now that we're 100% community funded, please become a sustaining member or increase your existing membership today.
Data breach exposes California student information: How to protect your family
Hackers stole personal and demographic information about millions of California public school students in a data breach revealed Friday by the California Department of Education.
Hackers allegedly accessed the information through the company ETS, which conducts standardized testing, including the California Assessment of Student Performance and Progress tests that start in third grade. Between May 22 and Sept. 18, 2026, an “unauthorized party” copied student information files, according to the CDE website.
However, ETS’ investigation did not find that the information has been made public.
What information was taken?
The breach exposed the information of 5.7 million students currently enrolled in transitional kindergarten through high school and those enrolled since 2023. Students who have left California since 2006 without notifying the state that they transferred to another school are also affected. That information could include:
- Student names, birthdays, addresses and schools
- Statewide student ID numbers (SSID)
- Demographic information, including race or ethnicity, gender, country of origin and English learner status
- A student’s disability and related academic support
- Whether a student is low-income or unhoused
- Statewide testing results
The breach is not reported to include:
- Parent or guardian information
- Social Security or driver’s license numbers
- Financial information
ETS is working with cybersecurity experts and law enforcement and is monitoring whether the students’ information appears publicly.
The California Department of Education is also collaborating with state cybersecurity experts and reviewing whether ETS complied with data security and requirements included in its contract with the state. The state has also set up a website with more information.
How to get help
ETS is emailing and sending letters to affected students and families to notify them of the breach and offer two years of free identity protection services. Separate services are available for minors and adults — both have a March 19, 2027 deadline to apply.
It’s important to know that not getting notified does not necessarily mean a student’s data is safe. Families can call a dedicated helpline, 833-931-8488, from 6 a.m. to 6 p.m. Monday through Friday.