Personal Data for Millions of California Students Stolen in Massive Breach (msn.com) 9
Millions of current and former students at California's public school have had their data stolen — including names, date of birth, and addresses — stolen in a breach, reports the Los Angeles Times.
The breach affects students "who took the state's mandated standardized tests that annually assess their academic proficiency, education officials announced Friday." The compromised information affects many more than the state's current 5.7 million public-school students as the breach dates back to 2023 enrollments. Students who left California but did not confirm their transfer to another school also were affected, dating back to 2006.
The data breach involved [nonprofit] Educational Testing Service or ETS, which provides extensive services to California [including test participation and assessment data]... Affected former students, including those who are now adults, are eligible for 24 months of free identity-protection services and identity-restoration help if there is identity theft. Officials said that parents and guardians may want to consider requesting a free credit freeze for their children who are under 16 to help prevent unauthorized accounts from being opened in the names of their children.
The breach involved a compromised login credential, according to a web page about the incident from California's Department of Education. The compromised credential was then used to copy files with student information at "various" times between May 22 and September 18, 2026, which drew concern from a cybersecurity expert interviewed by the Los Angeles Times: "A stolen login credential should not become a months-long passport to millions of students' personal records," said Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute. "If that is what happened here, the critical question is why authentication safeguards, access restrictions, and monitoring systems failed to detect and stop the unauthorized activity."
He added: "Incidents like this expose a fundamental weakness in how we manage student data: School systems may outsource the storage and processing of sensitive information, but they cannot outsource the consequences of a breach. When millions of student records are concentrated with a single vendor, one security failure can become a statewide problem with consequences that follow children for years."
A spokesperson for ETS told the Times that they've now implemented additional safeguards, including strengthened access controls, enhanced monitoring, and more third-party review of their security practices.
The breach affects students "who took the state's mandated standardized tests that annually assess their academic proficiency, education officials announced Friday." The compromised information affects many more than the state's current 5.7 million public-school students as the breach dates back to 2023 enrollments. Students who left California but did not confirm their transfer to another school also were affected, dating back to 2006.
The data breach involved [nonprofit] Educational Testing Service or ETS, which provides extensive services to California [including test participation and assessment data]... Affected former students, including those who are now adults, are eligible for 24 months of free identity-protection services and identity-restoration help if there is identity theft. Officials said that parents and guardians may want to consider requesting a free credit freeze for their children who are under 16 to help prevent unauthorized accounts from being opened in the names of their children.
The breach involved a compromised login credential, according to a web page about the incident from California's Department of Education. The compromised credential was then used to copy files with student information at "various" times between May 22 and September 18, 2026, which drew concern from a cybersecurity expert interviewed by the Los Angeles Times: "A stolen login credential should not become a months-long passport to millions of students' personal records," said Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute. "If that is what happened here, the critical question is why authentication safeguards, access restrictions, and monitoring systems failed to detect and stop the unauthorized activity."
He added: "Incidents like this expose a fundamental weakness in how we manage student data: School systems may outsource the storage and processing of sensitive information, but they cannot outsource the consequences of a breach. When millions of student records are concentrated with a single vendor, one security failure can become a statewide problem with consequences that follow children for years."
A spokesperson for ETS told the Times that they've now implemented additional safeguards, including strengthened access controls, enhanced monitoring, and more third-party review of their security practices.
Interenational problem can't be ignored (Score:3)
(The way AC should be.)
Local news has been filled with repeated incidents involving AI-empowered PII theft. It's especially nefarious in the situation where the exfiltrated data is not English. The people managing the data are not fluent in English, but the systems protecting the data are fundamentally English. The attackers have a major advantage when their English-based comprehension of the security systems is higher than the defenders' comprehension. After they have stolen the data they have plenty of ti
Re: (Score:3)
Re: (Score:2)
It's a special word for "Slashdot will always be broken so it can't check the spelling in the Subject." I did manage to catch one of those yesterday, but...
Just joking. There's actually a way to tweak my browser to prevent the Subject field from being excluded in the local spelling check, but then I run into another broken financial model where my browser may get broken at any time in some new way so they can add some new feature I'll never use...
However in relation to this story, if either setting creates
Fails to recognize the scope of the problem (Score:1)
When millions of student records are concentrated with a single vendor, one security failure can become a statewide problem with consequences that follow children for years.
The security of this information is rarely limited to a single vendor, though. It's the norm for schools and institutions to contract multiple vendors and they all want all the data. Only one of them has to get breached for it to be exposed.
Massive fines (Score:2)
Re:Massive fines (Score:5, Insightful)
Victim blame much? How about the police do their fucking job and arrest the perpetrators? Maybe trace the buyers of the data? Maybe issue Interpol warrants? Maybe sanction some individuals?
Americans are such weird people. They absolve criminals like they're inevitable and bash the innocents like they should know better. Oh look, it's so hard to fight Internet crime I just want my life to be easy let's pretend we've found the bad guys, problem solved.
In life, worthwhile things are often hard to do. That's not a reason to not do them.
Re: (Score:2)
Don't think of ETS as some victim because they're a not-for-profit. Like the College Board they own the market on standardized tests. Heck a quarter of their business comes from administering College Board tests. Basically every student in the world will have to encounter something from either company just as a matter of course, especially if they wish to enter a western college or university. And the tests aren't cheap.
They're companies that basically rake in tons of money they have to spend because they n