Your Child's Disability Records Were Stolen: 5.7 Million California Students Exposed

One Stolen Password. Four Months of Open Access.

A hacker found a single login credential. That's it. No sophisticated attack. No team of state-sponsored operatives. Just stolen credentials to a file-transfer site run by Educational Testing Service (ETS) for California's statewide student testing program. From May 22 to September 18, 2026, they copied files. Quietly. Undetected. For nearly four months.

ETS discovered the breach on September 25. California's Department of Education told the public on October 16. Three weeks of silence while 5.7 million families had no idea.

What Kind of Data Was Stolen?

The stolen records include full names, dates of birth, home addresses, statewide student IDs, race and ethnicity, country of origin, English learner status, and academic assessment scores. They also include disability types, testing accommodations such as IEP and 504 plan details, and federal program eligibility under Title I and McKinney-Vento.

These aren't generic profile fields. Your child's disability documentation is now in criminal hands. The fact that your family qualifies for federal homeless student protections is now in criminal hands. Unlike a password, none of this can be changed.

Social Security numbers, financial data, and parent or guardian information were not in the stolen files. That's a real boundary. But it's a narrow one.

How Does a File Transfer Site Become a Security Disaster?

SFTP servers are workhorses of institutional data sharing. School districts send test data up. Testing companies pull it down. The security of that whole system rests on the credentials protecting the access point.

When those credentials are compromised, there's no door to break down. The attacker just walks in. And if no one is watching closely, they keep walking in for 119 days.

That's what happened here. Four months of access to files covering 5.7 million currently enrolled students, plus records going back three school years. For some former students, records dating to 2006.

The Numbers

5.7 million currently enrolled California public school students are confirmed affected. Not a worst-case estimate. The confirmed floor.

Records stretch back to 2006 for some former students. If your child aged out of California public schools in the last two decades, their historical records may be included.

119 days of undetected access. Nearly the entire summer.

3 weeks between ETS discovering the breach and California publicly disclosing it.

ETS has shut down the compromised SFTP site and launched a replacement with enhanced security controls. They notified law enforcement and California's Cybersecurity Integration Center. They are offering 24 months of free identity protection to affected families.

What You Should Do Right Now

1. Claim the free identity protection. ETS is offering 24 months at no cost. Watch for official outreach from ETS or your child's school district with enrollment details. Do not click unsolicited links claiming to connect you to this service. Go through your district's official communication channels.

2. Freeze your child's credit at all three bureaus. Children's credit files are prime targets because fraud can go undetected for years. Contact Equifax, Experian, and TransUnion directly to freeze your child's credit. This is free. It takes about 15 minutes per bureau.

3. Document your child's disability and accommodation records now. IEP and 504 details are the fields that can't be rotated. If you ever see those details surface in an unexpected context, an insurance denial, an employment screen years from now, you will need a paper trail showing when the exposure occurred.

4. Stay alert to targeted phishing. Attackers who hold this data know your child's name, address, age, school, and disability status. That's enough to craft convincing impersonation attempts. Be skeptical of any contact claiming to be from a school, testing service, or government program that asks you to verify information or follow a link.

5. Request your child's educational records. Under FERPA, you have the right to inspect and review those records. Contact your school or district directly. Knowing exactly what's documented is the first step to monitoring for misuse.

6. Consider a security freeze for yourself. The stolen files didn't include parent data. But your address and family structure are now known context for a social engineering attempt aimed at you.

The Lock That Failed Was One Password

Breaches fall into two categories: the ones where you reset a password and move on, and the ones that follow a person for life. This is the second kind.

Disability documentation, ethnicity, IEP details, federal program eligibility, this is medical-adjacent, identity-defining information. It describes your child's learning needs, their background, and your family's economic circumstances. Criminals who hold it can deploy it in ways that aren't immediately obvious. Insurance underwriting. Employment screening. Targeted manipulation. These are established fraud patterns applied to a new dataset.

The credential that opened this door was one password. The system holding records on 5.7 million children, some going back 20 years, was protected by a single authentication point that nobody caught being abused for four months. That's not a sophisticated threat. That's a basic control failure at institutional scale.

Your child's data can't be un-stolen. What you can do is make it harder to weaponize.

Do this now:

• Enroll in 24 months of free identity protection through official ETS or district channels
• Freeze your child's credit at Equifax, Experian, and TransUnion (free)
• Document your child's IEP or 504 accommodation records
• Stay alert to phishing that uses your child's name, school, or specific circumstances
• Request a copy of your child's educational records from the district

Sources

• malwarebytes.com
• cbsnews.com