The breach stems from Education Testing Services (ETS), a nonprofit assessment organization that works with the California Department of Education (CDE).

 

What happened

On October 16th, the California Department of Education (CDE) began notifying California students and families about a data security incident. The data breach stemmed from unauthorized access of an ETS-operated site, which held data of California-based students. Data was accessed and ultimately copied by an unknown threat actor, who has still not be identified.

While it’s unclear how many students may have had their data accessed, CDE shared that copied data included information about students enrolled in a California public school over the last three years. While there is no confirmed number of involved individuals, estimates go as high as 7 million, according to Tech Insider.

 

Going deeper

According to CDE’s notice, data accessed may have included student names, Statewide Student Identifier (SSID), dates of birth, addresses, demographic information, disability and program participation information, and statewide assessment information.

Information like Social Security numbers, financial information, or parent/guardian information was not involved.

CDE said they expect all individuals to be notified by early November, which will allow more insight into how many individuals may have been impacted.

 

In the know

According to Tech Insider, the unauthorized access was initially identified on September 25th, 2026, by ETS. The discovery triggered an internal investigation, coordinated alongside CDE. The investigation found that there was no “evidence of public exposure,” which is a good sign, but does not necessarily mean that the data has not been exposed, leaked, or sold.

 

Why it matters

According to the Office of Government Accountability (GAO), “When a student’s personal information is disclosed, it can lead to physical, emotional, and financial harm.” The GAO conducted a large study to understand the impacts of a data breach on K-12 educational institutions, finding that many breaches against these organizations can leave students vulnerable to “emotional, physical, and financial harm.”

The GAO further found that “as schools and districts increasingly rely on complex information technology systems for teaching, learning, and operating, they are collecting more student data electronically that can put a student’s information, including PII, at risk of disclosure.”

Furthermore, these attacks can have strong legal ramifications on educational organizations, with the U.S. Department of Education noting that data breaches can result in violations of the Family Educational Rights and Privacy Act (FERPA). While the Department of Education says there are no specific required security controls, “Educational institutions should take appropriate steps to safeguard student records,” showing that educational organizations still have a burden to keep student data secure and could face legal repercussions if they fail to do so.

 

The big picture

Educational companies have increasingly been targeted by threat actors. In March of 2026, educational service provider Kaplan faced a data breach impacting 1.4 million individuals. EdTech giant McGraw Hill also faced a data breach in April of 2026, leading to approximately 13.5 million individuals having their data accessed. While both of these breaches had a large impact on students, the largest breach of the year has been against Instructure, the company behind Canvas, which was hacked in May of 2026. The data breach prevented students from accessing critical learning materials and resulted in approximately 275 million individuals having their data accessed.

While we wait to understand how many individuals were impacted by the breach against the CDE, it’s clear that educational institutions need to take cybersecurity very seriously.

 

FAQs

What is an SSID and is it valuable?

An SSID is a unique identifying number every student in the California public school system has. The number stays with them throughout their school experience, meaning that it is attached to a student’s records throughout school. It also has some financial value because it can be used to get up to $1,500 in educational benefits.

 

Why did ETS have data from California students?

ETS is functionally a business associate of the California Department of Education and is used to help provide testing services. Because of ETS’ role and integration into the school system, the tool had access to a significant amount of private information. The breach may, however, encourage CDE to reconsider how much data is provided to business partners.