A hacker has accessed the personal information of millions of students in California, United States, including their names, dates of birth, home addresses and disability status, after exploiting the systems of a non-profit organisation working with the state’s education department.
The California Department of Education disclosed the breach on Friday, saying the attacker accessed records belonging to students enrolled during the previous three school years.
More than 5.7 million students were enrolled in California schools during the 2025-2026 academic year, according to the department, although it did not specify the exact number of students whose records were accessed.
The breach involved Educational Testing Service, a non-profit organisation that administers statewide assessments in California, including English language proficiency tests.
According to the education department, the organisation discovered the security incident on September 25 while investigating suspicious activity involving a secure file transfer protocol site.
Investigators found that an unauthorised person had used compromised login credentials to access the system and copy files containing students’ information between May 22 and September 18, 2026.
The department said Educational Testing Service began notifying affected students and their families on Friday after investigating the incident, which was discovered late last month but had been ongoing for several months.
Although the stolen records contained sensitive personal information, the department said there was no evidence that the data had been made public.
It added that Social Security numbers and sensitive financial information were not accessed during the breach.
The incident has also disrupted some education assessment activities in the state. In a letter dated October 2 to county and district school officials, the department said Educational Testing Service had suspended its normal processing of enrolment data.
See also: Tesla’s Flying Car Wows the World, But Will It Get Approval to Fly?
“The CDE is actively working to minimize disruption and resume affected assessment activities in a timely manner,” the department said.
Educational Testing Service said it had introduced additional security measures following the incident, including enhanced monitoring, stronger access controls and further independent reviews of its security practices.
“We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices,” the organisation said in a statement to Reuters.
“Our priority remains the students, families and educators we serve and safeguarding the assessment programs we deliver for our clients and partners globally,” it added.
The breach highlights the risks associated with storing large volumes of children’s personal information on systems operated by third-party contractors, particularly when compromised login credentials can be used to access sensitive records.
The California Department of Education said it was working to minimise disruption while efforts continued to restore affected assessment activities.
About the Author
Cecilia Attah is a tech analyst with a degree from Benue State University. She covers tech news and startups at TechRegard with a focus on how technology is transforming Africa and shaping the global landscape.
