California Department of Education
CriticalReportedEducation
On 16 October 2026, the California Department of Education announced that student data had been stolen following an intrusion at ETS, a non-profit assessment organization working under contract for the state. An unauthorized party used a compromised login credential to copy files from a secure file transfer site between 22 May and 18 September 2026. Press reports say about 7 million students enrolled in California public schools over three years are affected. The data includes names, addresses, dates of birth, student identifiers, demographic information, disability status and assessment results; per the official notice, Social Security numbers and financial account data were not involved.
This information lets a malicious party impersonate a student or target families with credible phishing messages that refer to their schooling.
- Disclosed on
- October 16, 2026
- Incident dated
- May 22, 2026
- Accounts affected
- 7M
- Sector
- Education
- Country
- United States
- Cause
- Third-party provider
Exposed data
- Full name
- Postal address
- Date of birth
- Customer ID
- Health data
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact