California Testing Breach Exposed Students' Disability Records, Raising Privacy Stakes for Families

# California Testing Breach Exposed Students' Disability Records, Raising Privacy Stakes for Families

A compromised login at testing contractor ETS let an intruder copy statewide assessment files for months, including disability status, Section 504 status and testing accommodations

By Kaeleb Savon Heck | Mr. Blindbandit Chronicle. This is original reporting and analysis based on the public sources listed at the end.

SACRAMENTO, Calif. — An intruder using a stolen login copied files with personal information on millions of current and former California public school students from a file-transfer site run by Educational Testing Service (ETS), the state's testing contractor. The California Department of Education (CDE) announced the breach on Oct. 16, 2026. The files included information on students' disabilities, Section 504 status, testing accommodations and primary disability type.

According to the official notice ETS posted at the CDE's direction, an unauthorized party used a compromised login credential at various times from May 22 to Sept. 18, 2026, to reach an ETS secure file transfer protocol (SFTP) site used to exchange statewide assessment data with the department. ETS spotted the activity on Sept. 25.

The notice says the affected data includes, among others, all students enrolled in the three previous school years. Education Week reported that California had about 5.7 million public school students in the 2025–26 school year alone, and that some students who left the state without a confirmed transfer, going back to 2006, were also affected.

What was taken

The CDE notice says the information copied varies by student but may include:

• Name, date of birth, home address, school, district and grade level
• Statewide Student Identifier (SSID) and local student ID
• Gender, race or ethnicity, primary language, country of origin and English learner status
• Disability and Section 504 status, testing accommodations and primary disability type
• Eligibility for Title I, Part A; Title I, Part C; McKinney-Vento (homeless education); and Military Connected Student programs
• English language proficiency information and statewide test registration, participation and results

The notice says the data did not include Social Security numbers, driver's license or passport numbers, financial account or card information, or passwords. Parent and guardian information was not involved.

How ETS and the state responded

ETS is a nonprofit assessment organization. Under contract with California, it runs state- and federally required testing, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).

After finding the activity, ETS disabled the account, took the SFTP site offline, and began an investigation with outside cybersecurity experts, according to the notice. It has since built a new SFTP site with stronger security controls. ETS said that after working with law enforcement and cybersecurity experts it has taken steps to reduce the chance the data becomes public, and that its regular web monitoring has so far found no evidence the information has been published.

ETS is offering affected current and former students two years of free identity protection through Experian IdentityWorks. The CDE's incident page lists March 19, 2027, as the enrollment deadline. Families can call ETS at 833-931-8488, Monday through Friday, 6 a.m. to 6 p.m. Pacific time, according to notices that local districts have passed on to families.

Education Week noted a caution: having no evidence of publication is not the same as having no risk. Attackers sometimes keep stolen data private while they pursue a ransom.

Why disability data raises the stakes

Most breach coverage focuses on Social Security and card numbers because they lead directly to fraud. This breach is different. The most sensitive part of it is information about who a child is: disability type, accommodations, 504 status, homelessness eligibility, and English-learner status.

That kind of information cannot be changed. A card can be cancelled and a password reset. A child's disability record, tied to a name, birth date and home address, stays sensitive for years. Possible harms include targeted scams aimed at families of children with disabilities, stigma or discrimination if the data circulates, and more convincing social engineering, since a message that mentions a child's real school, grade and accommodations is far more believable.

The breach also shows a tension disability advocates know well. Collecting accommodation data is necessary. It is how schools make sure a blind student gets braille or screen-reader-compatible tests, or a student with a learning disability gets extended time. But every system that holds that data also has to protect it, and here the weak point was a vendor's file-transfer credential, not the student's school.

Analysis: a credential, a file-transfer site, and four months

The facts in the notice follow a familiar pattern: one compromised login, a system built for routine bulk transfers, and almost four months between first access (May 22) and detection (Sept. 25). File-transfer systems are attractive targets because they hold large, organized datasets and moving data in and out is their normal job, so unusual downloads can look like ordinary traffic.

Reported details do not say how the credential was compromised or whether multi-factor authentication protected the account. Those are fair questions for state lawmakers and education officials as they review vendor contracts.

What families should do

Based on the official guidance and standard practice:

1. Watch for the ETS notice and enroll in the free Experian IdentityWorks service before the March 19, 2027 deadline listed by the CDE.
2. Be wary of messages that cite school details. A call, text or email that mentions your child's school, grade or accommodations is not proof that it is legitimate.
3. Consider a credit freeze for minors where available. Children rarely have credit files, which makes them attractive targets for identity fraud.
4. Contact ETS directly at the number in official notices, not a number given in an unsolicited message.

What's next

• Direct notification. ETS has said it will notify affected students and families directly. Districts are already passing on the notice.
• Oversight. The CDE and the State Board of Education have said they are responding. Expect questions about vendor security requirements and data-minimization rules.
• Data exposure. Whether the files appear online, or are used in extortion, will shape how serious the consequences turn out to be.

The Chronicle will continue following the breach, especially as it affects students with disabilities.

Sources

• California Department of Education: Educational Testing Service (ETS) Notification
• Education Week: "Hackers Steal Personal Data of Millions of California Students in Massive Breach" (October 2026)
• Los Angeles Times: "Standardized testing hack exposes names and addresses of millions of students" (Oct. 16, 2026)
• Kaseya: "The Week in Breach News: October 21, 2026"