Millions of California Students Have Sensitive Data Stolen: Names, SSIDs, Home Addresses and More in Attack on Nonprofit
follow us
Add us as a preferred source on Google
- California Department of Education External Partner Victim of Data Breach Attack
- It is estimated that three years of students (5.7 million per year) are likely to be affected
- It appears that access was obtained through simple password theft.
Malwarebytes has reported that millions of current and former California public school students have had their sensitive personal information stolen following a massive data breach.
The breach occurred on a Secure File Transfer Protocol (SFTP) system used by Educational Testing Service (ETS), a third party used by the California Department of Education to manage student information.
According to the report, the attackers were able to regain access repeatedly over the course of four months, accessing student files filled with names, addresses, dates of birth and more.
Latest videos ofTechnologyRadar
California Student System Breach Likely Affects Millions
Although ETS has not officially revealed how many students have been affected, Malwarebytes notes that the state’s public schools served more than 5.7 million students in the year 2025-2026 alone. The state Department of Education believes that students who enrolled in the previous three years could be affected (or about 17 million students if the three years were the same).
Sensitive files were accessed and copied multiple times between May 22 and September 18, with the activity finally discovered on September 25, and it all comes down to human vulnerability.
Rather than a software vulnerability, it is believed that the attackers gained access through compromised credentials, although the complexities around the specific attack vector have not yet been shared.
ETS and the California Department of Education are working to notify affected individuals, who will be provided 24 months of identity protection software free of charge. No evidence appears to have been found to show that the stolen information was made public and it does not appear that a ransom threat was made.
“We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and additional third-party review of our security practices,” ETS added in a statement (via Reuters).
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment