Files holding information about current and former California public school students were copied from an Educational Testing Service system. Families should verify any notice before responding.
In 60 seconds
- Current and former California public school students may be included, including students from the previous three school years.
- Look for a notice from ETS or the California Department of Education, then verify it through an official channel.
- If notified, follow the instructions and consider the two years of free identity-protection services described there.
- Do not share passwords, security codes, or payment details with unexpected callers or messages.
Who should care and what to do today
This alert concerns current and former California public school students. The California Department of Education says the affected group includes all students enrolled during the previous three school years, although it may be larger. Parents and legal guardians may receive information or enrollment instructions for affected minors.
Look for a notice from Educational Testing Service, or ETS, and the California Department of Education. ETS is the nonprofit contractor that helps run California’s standardized tests. Verify any notice through an official website or contact channel found separately before clicking a link, replying, or sharing information.
If you receive a notice, follow its instructions. The report says affected adults can consider two years of free identity-protection services, while parents or legal guardians can enroll affected minors. Use the instructions for the correct age group.
General guidance: do not share passwords, security codes, or payment details in response to an unsolicited call, email, or text about the breach.
What information may be involved
Malwarebytes reports that the copied files may include a student’s name, Statewide Student Identifier, date of birth, home address, demographic information, disability or program participation information, and statewide assessment information such as test scores.
The information varied by person. Not every student had every category of information exposed. The report describes records that may contain education, testing, and program information, not just basic contact details.
The California Department of Education says Social Security numbers, financial account information, passwords, and parent or guardian information were not involved. ETS says it has found no evidence so far that the stolen information has been made public. These statements describe the information and findings reported by those organizations.
How the access happened
According to the report, an unauthorized party used compromised login details to access an ETS-operated secure file-transfer site and copy California student files at various times between May 22 and September 18.
A secure file-transfer site is a system used to send and store files for transfer. The report says ETS operated the site involved in this incident.
The report does not say that the copied information was later published or used in a scam. A message that mentions a child’s name, school, test, or disability program could still sound convincing. Verify unexpected contact through an official channel instead of trusting details supplied in the message.
What the enrollment figure does—and does not—show
The California Department of Education says more than 5.7 million students were enrolled in California public schools during the 2025–2026 school year alone.
That number provides enrollment context. It is not a count of confirmed affected people. The report says the affected population includes students from the previous three school years and is not limited to that group.
The supplied report does not identify a public lookup tool for checking individual names. If you are unsure whether a notice is genuine, find the California education or testing agency’s official website separately and use its published contact information.
Does this affect me?
- Who may be affected
- The source says current and former California public school students may be included, including all students enrolled during the previous three school years. Parents and legal guardians should also watch for notices concerning affected minors.
- How to check
- Look for a notice from Educational Testing Service or the California Department of Education, then verify it through an official website or contact channel found separately.
- What to do
- If notified, follow the notice and consider the two years of free identity-protection services described in it.
- What to avoid
- Do not share passwords, security codes, or payment details in response to an unsolicited call, email, or text about the breach.
Common questions
Does this breach affect every California student?
The California Department of Education says all students enrolled during the previous three school years are included, but the affected population is not limited to that group. The information involved varies by person.
What information may have been copied?
The report says the files may include names, Statewide Student Identifiers, birth dates, home addresses, demographic information, disability or program participation information, and statewide assessment information such as test scores.
Were Social Security numbers or passwords involved?
The California Department of Education says Social Security numbers, financial account information, passwords, and parent or guardian information were not involved.
How can a parent check whether a notice is real?
Verify the notice through an official California education or testing channel. Do not rely only on links, phone numbers, or contact details in an unexpected message, and do not provide passwords, security codes, or payment information.
What free help may be available?
The report says affected adults can consider two years of free identity-protection services, while parents or legal guardians can enroll affected minors. Use the instructions in the notice for the correct age group.
Primary source
This article is based on Malwarebytes’ report, “Millions of California students’ sensitive data stolen in breach,” published October 19, 2026: https://www.malwarebytes.com/blog/data-breaches/2026/10/millions-of-california-students-sensitive-data-stolen-in-breach. The report attributes incident details to the California Department of Education and Educational Testing Service. Read the complete original source.
Get the important updates without the noise
Choose the devices and topics you care about in Cyber Alerts.
Article history: Published Oct 19, 2026 at 7:25 am EDT. Updates and corrections are noted here when material facts change.
