The California Department of Education notified millions of public school students and their families Friday that a data security incident resulted in their personal information being stolen.

The hack itself targeted the Educational Testing Service, which is a nonprofit assessment organization that is under contract with the state to administer standardized tests.

The personal information that was exposed varied by student but included the names, addresses, demographic information and disability status of 7 million students enrolled in California public schools over the past three school years.

Social Security numbers, financial account information, passwords, and parent or guardian information were not involved.

The department said the incident occurred when an unauthorized party used a compromised login to access student information from an ETS-operated secure file transfer protocol site. 

ETS said it has since taken numerous measures to enhance the security of the site, including taking the SFTP site offline and building an entirely new site with enhanced security controls.

The hack took place at various times during the period from May 22 to September 18, 2026.

Misty Severi is a news reporter for Just The News. You can follow her on X for more coverage.