The California student records breach is the theft of millions of students' data — names, birth dates, addresses, even disability status — copied from a file-transfer site run by a state contractor. This data breach news check helps families understand their exposure and what to do about it.
— Ingenious AI security check.
Your child's school data does not live at the school — it lives at contractors you have never heard of, protected by logins you cannot see. The breach covered all students enrolled in the three previous school years. The check below walks through credit freezes for minors, the one protection that actually works.
Using a child's stolen personal data to open accounts or commit fraud — crueler than adult identity theft because a child has no credit history to monitor, so the fraud can run for years undetected.
The California Department of Education says a hacker copied the data of millions of students — names, birth dates, addresses, even disability status — from a secure file-transfer site run by contractor Educational Testing Service. The weapon wasn't malware. It was one compromised login credential, used quietly from May to September. Five questions in this data breach check on whether your family is ready for the fallout.
Short answer: your child's school data doesn't live at the school — it lives at contractors you've never heard of, protected by logins you can't see. Child identity theft is the cruelest kind: a kid has no credit file to watch, so fraud can run for years before anyone notices. The five questions below are the defenses that actually matter now.
Answer for your household.
| When | What |
|---|---|
| May 22 – Sep 18, 2026 | Unauthorized party used a compromised login credential to access ETS's secure file-transfer site and copy California student files, at various times. |
| Sep 25, 2026 | ETS identified the breach and began investigating. |
| Oct 2, 2026 | California Department of Education told districts ETS had stopped "normal enrollment data processing." |
| Oct 16, 2026 | ETS began notifying students and families; the department went public. Breach had run since May. |
Sources: Reuters · ET Education
Kids have no credit files — that's exactly why thieves love them. A freeze at each bureau blocks new accounts in your child's name. Check the FTC's guidance for freezing a minor's credit.
Every major breach spawns phishing waves that mimic the official notice. Go to the sender's official site yourself — never click the links in the email.
This breach came from a contractor, not the school. Districts share data with testing companies, bus-routing apps, lunch-payment processors. You can't protect data you don't know exists.
Run your address through Have I Been Pwned (haveibeenpwned.com), the free lookup run by security researcher Troy Hunt. It uses k-anonymity, so your full email never leaves your browser during the lookup. Never hand a lookup site your password — a real data breach check needs only your address.
A hacker copied the data of millions of students — names, birth dates, addresses, even disability status — from a secure file-transfer site run by a state education contractor.
Child identity theft is the cruelest kind: a kid has no credit history to monitor, so fraud opened in their name can run for years undetected. A credit freeze is the one protection that actually works.
The department says the hacker accessed data of all students enrolled in the three previous school years; more than 5.7 million students were enrolled in California during the 2025-2026 school year. Educational Testing Service began notifying students and families on October 16, 2026. If you did not get a notice, contact your school district.
According to the California Department of Education, Social Security numbers and sensitive financial information were not accessed. The department also said Educational Testing Service has not found that any of the information has been made public so far.
Change the password everywhere you reused it, enable two-factor authentication on every important account, and expect phishing emails that reference the breach — attackers buy these lists and personalize their lures. Then move to a password manager and passkeys so the next breach cannot hurt you.