A significant data breach involving the Educational Testing Service (ETS), a contractor for California's Department of Education (CDE), has compromised sensitive information of all public school students enrolled over the past three years. The breach, which occurred from May 22 to September 18, was discovered on September 25 when ETS found that hackers had accessed student data via a secure file transfer protocol site. ETS has since disabled the compromised account and taken the site offline, building a new platform to address the security lapse. The breach affects both current and former students who have been enrolled in California public schools from 2023 to the present, as well as students who left since 2006 without confirming a transfer to another school with the CDE. ETS, responsible for administering state assessments like the CAASPP and ELPAC exams, has paused normal enrollment data processing and some testing activities while investigations continue. Although no hacking group has claimed responsibility, ETS is collaborating with law enforcement and cybersecurity experts to mitigate risks and ensure the data does not become publicly accessible. The CDE began notifying affected families on October 16 and will continue to do so until November. The department is working with state cybersecurity experts to evaluate the breach's impact and is reviewing ETS's compliance with data security standards. Similar breaches have previously impacted other educational service providers, highlighting the ongoing risk faced by organizations handling sensitive student data.