Standardized testing hack exposes names and addresses of millions of students

Key Points:

• Hackers stole personal data, including names, addresses, disability records, and demographic information, of millions of current and former California public school students from Educational Testing Service (ETS), affecting enrollments dating back to 2006.
• The breach was discovered on September 25, 2026, involving unauthorized access via a compromised login credential between May 22 and September 18, with no evidence yet that the stolen data has been publicly released.
• ETS and California education officials are investigating the scope and impact, with ETS implementing enhanced security measures; affected individuals are offered 24 months of free identity protection and restoration services.
• The stolen data did not include Social Security numbers, financial information, or parent/guardian personal data, but officials warn families to be cautious of phishing attempts and consider credit freezes for children under 16.
• This incident follows previous major education-related cyberattacks in California, including a disruption of the Canvas platform in May 2026 and a ransomware attack on Los Angeles Unified School District in 2022, highlighting ongoing vulnerabilities in education data security.