Hackers stole personal information from 7 million California public school students as part of a massive breach, authorities announced Friday.
The information was accessed from a nonprofit that has a contract with the state Department of Education, Politico reported.
The information stolen includes students’ names, demographic information and disability status. The hack affected all students enrolled in the state public schools over the past three years.
A concept illustration represents a computer hacker stealing data from a laptop for network security, identity theft and computer crime, Thursday, Dec. 9, 2021. Brian Jackson – stock.adobe.com
The Education Testing Service (ETS) –– a nonprofit organization that administers standardized testing for California K-12 public schools –– was specifically targeted.
ETS manages California’s statewide assessments such as the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).
“On September 25, 2026, ETS identified unauthorized activity involving an SFTP site used to exchange California statewide assessment information with CDE,” the California Department of Education (CDE) said.
“ETS disabled the account involved, took the affected SFTP site offline, and initiated an investigation with the assistance of external cybersecurity experts. The investigation determined that an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026 to access the SFTP site to copy files containing California student information,” the agency added on.
A professional hacker sits at a table with a laptop, Friday, Dec. 14, 2018. Pixel-Shot – stock.adobe.com
As a result of the incident, ETS halted “normal enrollment data processing and paused certain testing activities while the security of its systems are assessed,” according to a letter sent out by CDE.
The company also decided to provide identity protection services through Experian IdentityWorks for two years.
While data regarding Social Security numbers, financial account information, passwords, driver’s licenses, and parent information were not involved, information about students’ date of birth and addresses may have been stolen.
A person types on a laptop computer. sornthanashatr – stock.adobe.com
This comes as another cyberattack unfolded on a learning module system called Canvas in April and May.
Canvas is widely used throughout colleges –– and in some K–12 schools –– across the country for students to upload homework, check the syllabus, and even to take tests.
The platform was originally hacked in late-April by a group called ShinyHunters. After the incident was believed to have been contained, Shiny Hunters hacked Canvas again on May 7 and threatened to release sensitive data.
An agreement with the group was eventually made a few days later to reclaim the stolen data.
Click Here For The Original Source.
——————————————————–
