The California Department of Education announced on the 16th that the personal information of approximately 7 million students who attended California public schools over the past three academic years was exposed in a student data hack. The leaked data includes students’ names, addresses, demographic information, and disability status.
The security breach occurred at Educational Testing Service (ETS), a non-profit educational evaluation organization contracted by the California Department of Education to handle academic achievement assessments. Widely known as the administrator of the TOEFL and TOEIC tests, ETS manages standardized academic assessments such as the Smarter Balanced tests and English language proficiency evaluations for California public schools.
According to the Department of Education, hackers used stolen login credentials to repeatedly copy files containing students’ personal information over an approximately four-month period from May 22 to September 18. ETS discovered the security breach on September 25, a week after the hacking activity ended. The department notified each school district on the 2nd and began notifying affected students and parents of the personal data leak starting on the 16th.
Immediately after confirming the security breach, ETS blocked the related servers, deactivated the accounts used in the intrusion, and reported the incident to law enforcement authorities, who are currently investigating. Student registration data processing and some testing operations have also been temporarily suspended for security audits.
However, it was confirmed that the leaked information did not include Social Security numbers (SSNs), driver’s license or passport numbers, or financial account information. Personal information belonging to parents and guardians was also found to be unaffected.
The Department of Education is collaborating with state cybersecurity experts to investigate the scale and impact of the damage, while also reviewing whether ETS properly fulfilled its contractual information security obligations. ETS plans to offer two years of free identity theft protection services to the affected students.
The department stated that student privacy remains its top priority, adding that it will provide necessary support to affected students and their families while thoroughly verifying the information security responsibilities of its contractors.
