California School Testing System Reports Data Breach

A security compromise exposed personal records for students enrolled in public schools over the last three years.

Updated on Oct. 20, 2026 in Cybersecurity

California School Testing System Reports Data Breach

Live Poll

Does the recent student data breach decrease your trust in your local school district's management?

A data breach occurring on September 25, 2026, exposed records for students in California public schools. The Educational Testing Service confirms hackers accessed student data between May 22 and September 18, 2026.

Why it matters

The incident compromises sensitive student data, necessitating widespread notifications to families across the state. Officials are working to mitigate the impact of the unauthorized access to student records.

The breach resulted in the copying of student names, birth dates, home addresses, IDs, and disability status. No financial data or social security numbers were accessed during the incident.

The players

Educational Testing Service

This private non-profit organization develops and administers standardized testing programs used by educational institutions.

The details

Hackers gained unauthorized access to the Educational Testing Service system by compromising a user account. This allowed them to copy records for public school students over a multi-month period.

May 22, 2026 - September 18, 2026: Hacker copied student records from the system.
September 25, 2026: The data breach occurred.
October 16, 2026: State officials began the notification process for affected individuals.
Early November 2026: The notification process is expected to conclude.

The Tech Race

This incident highlights the ongoing vulnerability of centralized data systems as cyber threats evolve. It underscores the critical need for robust identity authentication to protect against unauthorized account compromises.

Affected students and their families are receiving official notifications detailing the exposure of their personal information. Those impacted are being offered two years of identity protection services to help manage the risks associated with the breach.

The takeaway

Families should monitor their correspondence for official notifications regarding their specific data exposure status. Taking advantage of offered identity protection services is a recommended step to help secure personal information in the wake of the breach.