INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

California contractor breach exposes data of all public school students

| 2026-10-20 19:20 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A cyberattack on a contractor for California's Department of Education (CDE) exposed sensitive information covering all children enrolled in public schools over the last three years, specifically between 2023 and the current school year. The entity behind the attack is currently unknown as no hacking group has claimed responsibility. Approximately 5.7 million students were affected by this breach, including current and former students who left a California school since 2006. The attackers exploited a secure file transfer protocol site from May 22 to September 18, where they copied student information such as names, dates of birth, residential addresses, schools, districts, grade levels, SSIDs, local identifiers, gender, race or ethnicity, primary language, country of origin, English learner status, disability and Section 504 status, testing accommodations, eligibility for certain programs, and statewide assessment registration. Following the breach, ETS took steps to reduce the risk of data exposure by disabling the compromised account, taking its site offline, and building a new platform; however, no evidence has been found that the information was made publicly accessible as of Tuesday.
Technical Mitigations AI-generated
• Disable secure file transfer protocol sites from May 22 to September 18. • Block or hunt for evidence of public accessibility of the stolen data. • Review ETS's compliance with applicable data security and contractual requirements.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope educationeducation
Incident Timeline
‎between 2023
California public schools notified students enrolled between 2023 and the current school year, as well as those who left since 2006 without confirming transfer to another school.
‎2025 school year
Threat actors exploited a breach of ETS' testing services for California K-12 public schools, resulting in the theft of sensitive student data.
organisation California K-12
CDE hired ETS to provide testing to California K-12 public schools, which enrolled more than 5.7 million students in the 2025 school year.
general_metric 5.7 students
CDE hired ETS to provide testing to California K-12 public schools, which enrolled more than 5.7 million students in the 2025 school year.
‎September 25
Threat actors used a contractor's account to steal data from ETS, prompting the company to disable and eventually take offline its compromised platform.
‎2026/10/13
California's public school students were warned of a data breach at Educational Testing Service, which occurred months prior to the warning being released.
tactic Data Breach
The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.
organisation Educational Testing Service
The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.
‎October 16
The state of California began notifying families of a data breach involving contractor theft on October 16.
‎May 22 to September 18
Hackers copied student information through a secure file transfer protocol site from May 22 to September 18.
‎2026/10/20
Threat actors successfully breached a contractor for California's Department of Education, exposing sensitive information covering all children enrolled in public schools over the last three years.
organisation California’s Department of Education
A cyberattack on a contractor for California’s Department of Education (CDE) exposed troves of sensitive information covering all children enrolled in public schools over the last three years.
organisation CDE
A cyberattack on a contractor for California’s Department of Education (CDE) exposed troves of sensitive information covering all children enrolled in public schools over the last three years.
organisation Statewide Student Identifiers
The student information copied by hackers includes: Student names, dates of birth, residential addresses, schools, districts, and grade levels; Statewide Student Identifiers (SSID) and local student identifiers; Gender, race or ethnicity, primary language, country of origin, and English learner status;
organisation McKinney-Vento
Disability and Section 504 status, testing accommodations, and primary disability type; Eligibility status for the following programs: Title I, Part A; Title I, Part C; McKinney-Vento; and Military Connected Student; and/or English language proficiency information and statewide assessment registration, participation, and results, where applicable.
organisation CAASPP
ETS manages the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC) exams given each year.
organisation Illuminate
Educational service providers like ETS have been repeatedly targeted by cybercriminals – with multiple incidents impacting large companies like PowerSchool , Instructure , Illuminate Education , McGraw Hill , Kaplan and more.
organisation McGraw Hill
Educational service providers like ETS have been repeatedly targeted by cybercriminals – with multiple incidents impacting large companies like PowerSchool , Instructure , Illuminate Education , McGraw Hill , Kaplan and more.
Intelligence Sources
TheRecord 2026-10-20