California's Department of Education said on Friday that a hacker accessed the data of millions of students, including names, birth dates, addresses and disability status, by exploiting the system of a non-profit contractor that works with the state.
The hacker accessed the data of "all students enrolled in the three previous school years," the department said. More than 5.7 million students were enrolled in California during the 2025-2026 school year, according to the department.
The contractor, Educational Testing Service, administers statewide assessments in California, including tests for English language proficiency. It identified the breach involving a secure file transfer protocol site on September 25 and began an investigation.
"The investigation determined that an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026," the education department said.
Educational Testing Service began notifying students and their families on Friday. The department said the service had not found that any of the information had been made public so far, and that Social Security numbers and sensitive financial information were not accessed.