Families across California — including Punjabi families throughout the Central Valley, from Stockton and Sacramento to Fresno and Bakersfield — are opening letters this week telling them that their children's school records were copied by a stranger. According to the California Department of Education (CDE), an unauthorized person used a compromised login credential to access a secure file transfer (SFTP) site run by Educational Testing Service (ETS) and copied files containing California student information at various times between May 22 and September 18, 2026 — roughly four months of access before it was stopped.

Source: California Department of Education

ETS is the nonprofit organization under contract with the State of California to run the state and federally required tests taken by every student in California public schools. It supports the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC), so the files on that transfer site covered testing data for students in every public school district in the state, including every district in the Valley.

What was taken — and what was not

The state says the information accessed and copied varies by student, but may include the student's name, date of birth, residential address, school, district and grade level; the Statewide Student Identifier (SSID) and local student ID; gender, race or ethnicity, primary language, country of origin and English learner status; disability and Section 504 status, testing accommodations and primary disability type; eligibility for programs such as Title I, the McKinney-Vento program for students experiencing homelessness, and the Military Connected Student program; and English proficiency and statewide assessment registration, participation and results.

Just as important is what the state says was NOT in the copied data: no Social Security numbers, no driver's licence or passport numbers, no financial account information, no credit or debit card information and no account passwords. The incident also did not involve any personal information about parents or guardians, according to the official notice.

How many students are affected? The state has not said

Neither ETS nor the state has published an exact number of students affected, and families should treat any single figure circulating this week with caution. The official notice describes the covered group instead: information was accessed on students enrolled in the three previous school years, and the notification also reaches former students — including students who left a California school as far back as 2006 without a confirmed transfer. For scale, about 5.7 million students are enrolled in California public schools in 2025–26; that is the size of the current cohort, not a confirmed count of victims. KSEE24/CBS47 reported on October 30 that the breach could affect every student enrolled in California since 2023, and LAist reported the exposure covered information on the 5.7 million students now enrolled from transitional kindergarten through high school, plus students enrolled since 2023.

Source: Check The 99 (reporting KSEE24/CBS47 and LAist)

What ETS and the state say they have done

ETS says it identified the unauthorized activity on September 25, 2026, disabled the account involved, took the affected SFTP site offline and opened an investigation with external cybersecurity experts. It has since built an entirely new SFTP site with enhanced security controls. Law enforcement agencies were notified. ETS says that, following regular web monitoring, it has to date found no evidence that the copied information has been made public. On the state side, the California Cybersecurity Integration Center (Cal-CSIC) is assisting with forensics and incident response, the California Department of Technology and the Governor's Office of Emergency Services (Cal OES) are supporting the response, and CDE and the State Board of Education are reviewing ETS's compliance with its data-security and contractual requirements — a review whose findings have not yet been announced.

Why this lands hard in the Central Valley

The Central Valley is home to one of the largest Punjabi communities in the United States, and its children fill the public schools of Fresno, Sacramento, Stockton, Modesto, Bakersfield and Yuba City — every one of those districts tests through CAASPP and ELPAC, so Valley families should assume the letter applies to them if their child was enrolled at any point since 2023. The official notice is available in 27 languages on the CDE incident page, including Punjabi and Hindi. Education Week and Government Technology reporting on the breach notes that experts are urging stronger accountability for education-technology vendors: TJ Sayers of the Center for Internet Security cautioned against treating massive breaches as normal, and Doug Levin of the K12 Security Information Exchange recommended that families consider free credit freezes for themselves and their children. A proposed class-action lawsuit against ETS alleging inadequate safeguards has also been reported; it is a filing, not a finding, and ETS's compliance review by the state is still pending.

Source: Government Technology

What happens next

Family notification letters began going out on October 16 and continue through early November, according to the state, and updates are posted at cde.ca.gov/ets if more information becomes available. The two dates that matter for families are the enrolment deadline of March 19, 2027 for the free identity protection, and the still-unannounced results of the state's compliance review of ETS. What is still unknown is who used the compromised login, how it was compromised, and the exact number of students whose files were copied — none of which the state or ETS has answered yet.