Slashdot has reported:

Millions of current and former students in California’s public schools had personal information stolen in a data breach involving Educational Testing Service (ETS), a nonprofit that provides services to the state, including test participation and assessment data. The exposed information includes names, dates of birth and addresses. The affected students took state-mandated standardized tests that assess academic proficiency each year, education officials announced Friday.

The breach reaches beyond California’s 5.7 million current public-school students. It includes students enrolled in 2023 and former students who left California but did not confirm a transfer to another school, going back to 2006. Some of those former students are now adults.

The California Department of Education’s incident webpage says a compromised login credential was used to copy files containing student information at various times from May 22 to September 18, 2026. Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute, raised concerns about the duration and scale of access.

“A stolen login credential should not become a months-long passport to millions of students' personal records,” Dahbura said. “If that is what happened here, the critical question is why authentication safeguards, access restrictions, and monitoring systems failed to detect and stop the unauthorized activity.”

He said the incident points to a broader vulnerability in the handling of student information. “Incidents like this expose a fundamental weakness in how we manage student data: School systems may outsource the storage and processing of sensitive information, but they cannot outsource the consequences of a breach. When millions of student records are concentrated with a single vendor, one security failure can become a statewide problem with consequences that follow children for years.”

An ETS spokesperson said the company has introduced additional safeguards, including stronger access controls, enhanced monitoring and more third-party reviews of its security practices.

Affected former students can receive 24 months of free identity-protection services and help restoring their identity if they experience identity theft. Officials also said parents and guardians may want to request a free credit freeze for children under 16, which can help prevent unauthorized accounts from being opened in their names.