One Compromised Login Exposed Millions of California Students’ Records

An unauthorized party used a compromised login credential between May 22 and September 18, 2026 to access an Educational Testing Service SFTP site and copy files containing California student information, according to the California Department of Education. The files could cover students enrolled in the three previous school years and some who left as far back as 2006, and may include names, birth dates, addresses, school and grade, ID numbers and, for some, disability and testing information, SecurityWeek reports.