Hackers steal sensitive personal info from millions of California students in massive breach

Read the original at New York Post ↗
Cite

Choi, J. (2026, October 16). Hackers steal sensitive personal info from millions of California students in massive breach. New York Post. https://nypost.com/2026/10/16/us-news/nearly-7m-california-students-data-exposed-in-mass-testing-hack/

Dated from the outlet's own feed. Check the original for its byline.

New York Post · collected 2026-10-17 · by Justin Choi

Quick Summary

Hackers stole sensitive personal information including names and disability status of all students enrolled in California public schools over the past three years. The breach targeted the Education Testing Service (ETS), which administers standardized tests for K-12 education in California, from May 22 to September 18, 2026. ETS identified unauthorized activity on an SFTP site used to exchange assessment data with the California Department of Education and immediately disabled the compromised account while initiating a cybersecurity investigation.
Written locally by qwen2.5:14b on 2026-10-17, using this article's own text rather than the other coverage of the same event (that is the story summary below).

AI analysis runs on qwen2.5:14b, locally

Story summary

On September 25, 2026, hackers stole sensitive personal information from millions of California students in a massive breach. The Education Testing Service (ETS), which administers standardized testing for California K-12 public schools, identified unauthorized activity involving an SFTP site used to exchange data with the California Department of Education (CDE). The investigation revealed that an unauthorized party accessed the SFTP site from May 22, 2026, to September 18, 2026, using a compromised login credential. Affected students' names, demographic information, and disability status were among the stolen data, impacting all public school students in the state over the past three years. ETS disabled the compromised account and initiated an investigation with external cybersecurity experts.

Written for “California Student Data Breach” on 2026-10-17, grounded in this article and the 0 other(s) covering the same event.
Why this leaning score
This article does not take a side on a contested political question, so it has no leaning score. That is an answer rather than a gap: a match report or a rescue can be warmly or critically written without being left or right, and scoring it anyway is how approval of a subject gets recorded as a political position.
No political leaning scored for article 86245 · logged 2026-10-17

Story

📰 California Student Data Breach
Education · 1 article(s) covering the same event.

Compared with similar articles

This article reads unscored and hedges 14% of its claims. Each row says how that neighbour differs.
Global News
⚖️ leaning not scored 🔴 30% hedged 3 of 10 📰 publisher trust 63
“The articles describe different cyberattacks affecting distinct educational systems in Burnaby and California.”
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
7
sentences that state something as happening or true
Uncertain
14%
1 of 7 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
67/100
New York Post's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
1
Education
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-10-17 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

New York Post · 11076 article(s) · 31 correction(s) detected
Running correction rate · 31 correction(s)

Who wrote this

Justin Choi
39 article(s) here · 1 carrying a prediction
🔮 Thankfully she wasn’t on the right lane because if she was on the right lane, she would’ve been toast,” the witness added.
🔮 The investigation determined that an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026 to access the SFTP site to copy files containing California student information,” CDE added on.
🔮 “How willing is our political will under this council to hold the city manager and this workforce accountable?
🔮 The GoFundMe will be used to help Martina and her three kids rebuild by replacing “clothing, beds, toys, furniture, and other everyday necessities, including Martina’s personal belongings that were still in the home.” $3,000 of the fundraiser’s $4,000 goal has been raised so far. Another dog in Maryland destroyed a home this past summer after accidentally turning on a toaster.
🔮 The ordinance will head to Mayor Karen Bass for final approval following Wednesday’s vote.
2026-10-08 · assertive framing · LA cracks down on drug-huffing partygoers with key move
🔮 After baking in triple-digit temperatures for days, SoCal could get its first taste of the rainy season Sunday as Rachel gets ripped apart by a powerful low-pressure system off the California coast and sends a slug of tropical moisture north. “Please beware of sudden changes in our weather from extreme heat to tropical weather,” meteorologist Jason D. Farhang warned Wednesday.
🔮 The new study, conducted by Clever Real Estate, compares current median home prices versus what homes would cost if prices kept pace with inflation since 1984.
🔮 Thermal hotspots were displayed as red dots and “could be the beginnings of wildfires, or they may be false positives that the satellite picked up … like volcanic activity, oil and natural gas wells,” according to the map. It comes as California baked in a record-breaking heat wave. Southern California has seen an unusually high streak of 100 degree weather over the past week.
🔮 N17 — the developer behind the proposed 80 Willow Road project — sued Menlo Park on Friday after the city rejected the controversial mixed-use development planned for a 6.7-acre site.
🔮 Los Angeles is rolling out 125 speed cameras across the city, with the first wave expected to be installed by Halloween and fines eventually reaching as high as $500 for the heaviest-footed drivers.
2026-10-02 · assertive framing · More than 100 new LA speed cameras go live this month
Also by Justin Choi
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 39 articles by Justin Choi →

Topics

CDE California ETS The Education Testing Service the California Assessment

Subjects

California GPE · 4× ETS ORG · 4× CDE ORG · 3× ELPAC ORG · 1× The Education Testing Service ORG · 1× the California Department of Education ORG · 1×

Narrative

“On September 25, 2026, ETS identified unauthorized activity involving an SFTP site used to exchange California statewide assessment information with CDE,” the California Department of Education (CDE) said.
framing: assertive · carried by 1 article(s) · first seen 2026-10-17
🔮 The investigation determined that an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026 to access the SFTP site to copy files containing California student information,” CDE added on.

Claims (7 extracted, 1 hedged)

The information stolen includes students’ names, demographic information and disability status. asserted
information → steal → names
The hack affected all students enrolled in the state public schools over the past three years. asserted
hack → affect → years
The Education Testing Service (ETS) –– a nonprofit organization that administers standardized testing for California K-12 public schools –– was specifically targeted. asserted
that → administer → schools
ETS manages California’s statewide assessments such as the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC). asserted
ETS → manage → California
“On September 25, 2026, ETS identified unauthorized activity involving an SFTP site used to exchange California statewide assessment information with CDE,” the California Department of Education (CDE) said. asserted
Department → identify → Education
“ETS disabled the account involved, took the affected SFTP site offline, and initiated an investigation with the assistance of external cybersecurity experts. asserted
ETS → disable → experts
The investigation determined that an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026 to access the SFTP site to copy files containing California student information,” CDE added on. uncertain
CDE → determine → information
💬Give feedback
🕘History 🎫Support