# California Schools Respond to Student Data Breach

A breach of an Educational Testing Service (ETS)-operated file-transfer system exposed sensitive records of millions of current and former California public school students. Unauthorized access occurred from May 22 through September 18, 2026; ETS detected suspicious activity on September 25. California notifications are expected to continue through early November. The incident highlights risks in contractor-operated systems and the importance of credential security, student-data handling, and oversight of third parties. No new solicitation or contract opportunity is identified.

- Procurement teams and education agencies can use the incident to reassess oversight of contractors handling student data, including access controls and security practices for file-transfer systems.
- Contractors serving education clients should be prepared to demonstrate how they protect sensitive records and manage credentials in systems they operate.
- Notifications are expected to continue through early November; the signal does not specify a response deadline or procurement action.

**Jurisdictions:** sled
**Industries:** Education
**Topics:** Cybersecurity
**Published:** October 18, 2026

### Government Entities
- California Department of Education (CDE)

### Vendors
- Educational Testing Service (ETS) (Operator of the breached file-transfer system)
- Experian ()

### Sources
- [Hackers steal personal data of millions of current and former California public school students · Business Upturn](https://businessupturn.com/usa/news/hackers-steal-personal-data-of-millions-of-current-and-former-california-public-school-students) - Business Upturn