California student data breach sparks scrutiny |
A September 2026 data breach involving Educational Testing Service (ETS), California's statewide assessment contractor, exposed sensitive information belonging to millions of current and former public school students, including names, birth dates, addresses, assessment records, and certain disability-related data. The incident, which involved unauthorized access through a compromised login credential, has prompted a proposed class-action lawsuit against ETS and a California Department of Education review of the company's data-security compliance. Cybersecurity experts warn that inadequate vendor oversight, excessive data retention, inconsistent security standards, and limited funding leave K-12 institutions vulnerable to preventable attacks. Experts estimate that approximately 80% of school-related cybersecurity incidents could be avoided through basic security measures, including stronger access controls, improved vendor accountability, and better data management. They are urging policymakers to establish dedicated cybersecurity funding, strengthen contractual safeguards, and support smaller school districts with specialized resources.