---
title: "Data breach at California Department of Education"
description: "On 16 October 2026, the California Department of Education announced that student data had been stolen following an intrusion at ETS, a non-profit assessment organization working under contract for the state. An unauthorized party used a compromised login credential to copy files from a secure file "
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-10-16-california-department-of-education
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-10-16
dateModified: 2026-10-16
---
# California Department of Education

Data breach — Critical

On 16 October 2026, the California Department of Education announced that student data had been stolen following an intrusion at ETS, a non-profit assessment organization working under contract for the state. An unauthorized party used a compromised login credential to copy files from a secure file transfer site between 22 May and 18 September 2026. Press reports say about 7 million students enrolled in California public schools over three years are affected. The data includes names, addresses, dates of birth, student identifiers, demographic information, disability status and assessment results; per the official notice, Social Security numbers and financial account data were not involved.

This information lets a malicious party impersonate a student or target families with credible phishing messages that refer to their schooling.

| Fact | Value |
| --- | --- |
| Disclosed on | October 16, 2026 |
| Incident dated | May 22, 2026 |
| Accounts affected | 7M |
| Sector | Education |
| Country | United States |
| Cause | Third-party provider |
| Severity | Critical |
| Status | Reported |

## Exposed data

- Full name
- Postal address
- Date of birth
- Customer ID
- Health data
- Other personal data

## What you can do

- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Hack exposes data on millions of California students](https://databreaches.net/2026/10/17/hack-exposes-data-on-millions-of-california-students/) — DataBreaches.net

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-10-16-california-department-of-education
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees