Someone spent four months copying California school records. Nobody noticed until September

The California Department of Education went public on 16 October. Educational Testing Service, the New Jersey nonprofit that administers the state's standardised assessments, found that an unauthorised party had used a stolen login to copy files from a secure file transfer site. The copying ran from 22 May to 18 September. It was discovered on 25 September.

The scope is the striking part. Every student enrolled in a California public school across the last three school years is covered, which is more than 5.7 million for the 2025 to 2026 year alone, plus records of former students stretching back to 2006. What was taken: names, dates of birth, home addresses, statewide student identifiers, grade level, school and district, race or ethnicity, primary language, country of origin, English learner status, disability information, programme eligibility and assessment scores. What was not: Social Security numbers, driver's licence or passport numbers, bank or card details, account passwords, and nothing about parents or guardians.

ETS took the transfer site offline, disabled the account that was abused, rebuilt it with tighter controls, and is offering two years of identity protection. Notices started going out on 16 October and run into early November. There is no sign yet that the data has been published anywhere. The practical risk for a family is a message that knows your child's school, grade and teacher and uses that to sound official. Treat any such contact as unverified until you have phoned the district on a number you looked up yourself, and enrol the child in the monitoring offer rather than ignoring the letter.

For the accounts on your own PC, Tendvane's Privacy and accounts check shows which ones exist, which are signed in, and which have no password protecting them at all.