Technology
Millions of California students' data stolen in ETS-linked breach, officials say
According to Slashdot, officials say a compromised login at testing nonprofit ETS was used to copy student files from May to September 2026.
The short version
- Officials announced that personal data of millions of current and former California public-school students was stolen in a breach involving nonprofit Educational Testing Service (ETS).[Slashdot]
- Stolen records include names, dates of birth, and addresses, and reach back to 2023 enrollments and to 2006 for some former students.[Slashdot]
- A compromised login credential was used to copy student-information files at various times from May 22 to September 18, 2026, according to the California Department of Education.[Slashdot]
- ETS says it has added safeguards, while a Johns Hopkins expert questions why the activity went undetected.[Slashdot]
Key facts
- Millions of current and former California public-school students had personal data stolen, including names, dates of birth, and addresses.[Slashdot]
- The breach involved Educational Testing Service (ETS), a nonprofit that provides test-related and assessment services to California.[Slashdot]
- Officials announced that the breach affects students who took the state's mandated standardized tests.[Slashdot]
- The compromised information reaches beyond the state's 5.7 million current public-school students, dating to 2023 enrollments and to 2006 for students who left without confirming a transfer.[Slashdot]
- A compromised login credential was used to copy student-information files at various times between May 22 and September 18, 2026, according to the California Department of Education.[Slashdot]
- ETS says it has implemented strengthened access controls, enhanced monitoring, and more third-party review of its security practices.[Slashdot]
What remains uncertain
- It is unresolved why authentication safeguards, access restrictions, and monitoring did not detect the activity; a Johns Hopkins expert raised this question and has not identified a cause.[Slashdot]
- The exact date of the announcement is not stated; the source says only that officials announced it on a Friday.[Slashdot]
- The story rests on a single outlet, Slashdot, summarizing Los Angeles Times reporting, and no independent confirmation was provided in the source set.[Slashdot]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.