SACRAMENTO — Educational Testing Service, the nonprofit contractor that runs California's statewide student assessments, is notifying affected students and families across the state that an unauthorized party accessed and copied student records over nearly four months this year before anyone caught it.

According to a California Department of Education notice, ETS says someone used a compromised login credential to access a secure file-transfer site — the system ETS uses to exchange statewide assessment data with the state — and copied student files between May 22 and September 18, 2026. The intrusion wasn't discovered until September 25. Neither ETS nor CDE has released a count of how many students are affected.

What was exposed

The information varies by student but can include full names, state-issued student ID numbers, dates of birth, home addresses, demographic details, disability and program-participation records, and statewide assessment data. ETS says Social Security numbers, financial account information, passwords and parent or guardian information were not involved. As of the breach notice, ETS said its web monitoring had turned up no evidence the stolen data had been posted publicly.

NO EVIDENCE OF PUBLIC EXPOSURE — SO FAR.

ETS took the compromised file-transfer site offline and built a replacement with what it describes as enhanced security controls, and says it is working with law enforcement and outside cybersecurity experts. Current and former students covered by the breach are being offered two years of free identity-protection monitoring through Experian IdentityWorks. The state's Department of Education, under State Superintendent Tony Thurmond, began mailing notices on October 16 in 27 languages, with the rollout expected to continue through early November.

Part of a pattern

The ETS breach adds to a run of incidents involving school-system vendors rather than the schools themselves. A 2024 breach at the student information platform PowerSchool exposed records tied to districts nationwide, and a 2021 hack of the online grading system used by New York City schools compromised data on roughly 820,000 students. Each case has turned on the same vulnerability: a single compromised vendor credential giving an intruder a back door into student data held by schools that never touched the breached system directly.

For now, California officials say they have no evidence the stolen files have circulated beyond the original intrusion, but the monthslong gap between the breach and its discovery means affected families won't know for certain whether their information was misused until notices — and the credit monitoring that comes with them — finish going out in the coming weeks.