---
title: Stolen Login Sat Inside a State Testing Contractor for Four Months
description: Sensitive California student data copied from a testing contractor’s file transfer site between May and September. Free identity protection offered to students.
canonical_url: https://codekeeper.co/ticker/california-student-data-breach-2026
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Data breaches](https://codekeeper.co/ticker/tag/data-breaches)

# Stolen Login Sat Inside a State Testing Contractor for Four Months

Sensitive California student data copied from a testing contractor’s file transfer site between May and September. Free identity protection offered to students.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 20, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A single stolen login credential gave an unauthorized party access to sensitive records for California public school students. Educational Testing Service (ETS), which runs state testing programs including CAASPP and ELPAC, discovered the breach on September 25 — but the credential had been used at various times to copy files since May 22, with the last access on September 18. The files came from an SFTP site ETS shared with the California Department of Education. No victim count has been given. The department says the data covers students enrolled from 2023 onward, plus anyone who left a California school since 2006 without a confirmed transfer elsewhere — and more than 5.7 million students were enrolled in 2025-2026 alone. Stolen data includes names, birth dates, addresses, Statewide Student Identifiers, disability status and Section 504 status, testing accommodations, and test results, though not every student had every category exposed. Social Security numbers, passwords, and financial details were not in the files, and parent information wasn’t involved. ETS disabled the account, pulled the site offline, and built a replacement. How the credential was stolen and who used it remain unknown, though ETS says its web monitoring has found no sign the data has been published. CDE and the State Board of Education are now reviewing whether ETS met its security and contractual obligations. Notification letters started going out on October 16 and continue into early November. **Source:** [SecurityWeek](https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcalifornia-student-data-breach-2026%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Critical RCE Flaws in Cursor IDE Let Attackers Escape Sandbox With Zero Clicks Aug 12, 2026](https://codekeeper.co/ticker/cursor-ide-vulnerabilities-remote-code-execution)

[AWS Links npm Supply Chain Attacks to North Korean Hackers Aug 11, 2026](https://codekeeper.co/ticker/north-korean-group-targets-npm-libraries)

[Cyberattacks AI-Made Phishing Decoys Are Hiding Malware in Windows Shortcuts Sep 8, 2026](https://codekeeper.co/ticker/north-korea-kimsuky-ai-phishing-malware)

[Cyberattacks Critical Fortinet FortiMail Zero-Day Under Active Attack Oct 2, 2026](https://codekeeper.co/ticker/fortimail-zero-day-vulnerability-cve-2026-104286)