The Booba Project ransomware group has listed the California School Boards Association (CSBA) on its leak site and says it stole 80GB of the organisation's data. CSBA is the statewide body that represents and supports the elected boards running California's school districts and county offices of education. This is still just a criminal claim. CSBA has not confirmed or denied a breach, no regulator filing has been published, and the group has not shown any samples that would let anyone check the 80GB figure. Booba Project is the same group behind the recent attack on the University of Illinois Chicago (UIC). CSBA is a new victim. The claim lands two weeks after California's Department of Education disclosed a separate, confirmed breach at its testing contractor, Educational Testing Service (ETS), which exposed records on millions of public school students. Nothing published so far links the two incidents.
What Happened
Threat intelligence outlet QPulse reports that Booba Project claimed the attack on October 29, 2026. The listing was picked up by the Ransomware.live tracker, which gives October 29 as the estimated attack date. That is very likely the date the claim was posted, not the date of the intrusion. Leak-site dates usually trail the actual break-in by days or weeks.
QPulse also cites outside credential-monitoring data on CSBA:
- HudsonRock found infostealer infections linked to the "Cavalier" stealer family, involving two user accounts connected to the organisation.
- ParanoidLab found 417 exposed passwords, 20 of them rated critical, plus 2 session cookies, in an external scan of CSBA's attack surface.
QPulse says it could not confirm how the attackers got in or whether CSBA's systems are still affected. CSBA has made no public statement. Until it does, or the group publishes data that can be checked, readers should treat both the intrusion and the 80GB figure as unverified.
A separate incident in the same sector. On October 16, the California Department of Education (CDE) told every school district in the state that ETS had been breached. ETS runs the CAASPP and ELPAC assessments. The Record, SecurityWeek, the Los Angeles Times (via EdWeek) and CBS San Francisco all report the same account. An attacker used one compromised login to reach an ETS file transfer (SFTP) site and copied student files at various times between May 22 and September 18, 2026. ETS spotted the activity on September 25. The Los Angeles Times reports that district leaders were told on October 2, two weeks before the public notice. This is a confirmed breach of a different organisation. Nobody has publicly named an attacker, and nothing ties it to Booba Project or CSBA.
What Was Taken
At CSBA (claimed): Booba Project says it took 80GB. It has not said what kind of data that is, and no file listings or samples have been reported. As an association serving school boards, CSBA probably holds member records, board governance and policy material, staff information and correspondence with districts. That is an inference from what the organisation does, not something anyone has reported. QPulse's account of exposed credentials suggests stolen logins may be part of the risk, whatever the 80GB contains.
At ETS (confirmed, separate incident): CDE's notice says the copied files cover "including but not limited to all students enrolled in the three previous school years". It also covers students who left a California school as far back as 2006 without a confirmed transfer. CDE has not given a victim count. All outlets cite CDE's own enrolment figure of more than 5.7 million students for 2025-26 for scale. The Los Angeles Times notes that the true total is well above that, because the data goes back to 2023 enrolments and includes students who left as far back as 2006. The data includes:
- Names, dates of birth, home addresses, school, district and grade level
- Statewide and local student identifiers
- Gender, race or ethnicity, primary language, country of origin, English learner status
- Disability and Section 504 status, primary disability type, testing accommodations
- Eligibility for Title I, migrant education, McKinney-Vento (homeless students) and military-connected programmes
- English proficiency data and assessment results
Irvine Unified and San Juan Unified, passing on CDE's notice, say the files did not contain Social Security numbers, driver's licence or passport numbers, financial information, passwords, or any parent or guardian information. Keyes Union School District says ETS reports no evidence so far that the data has been made public. ETS is offering two years of Experian IdentityWorks. Families can enrol students under 18 until March 19, 2027.
Why It Matters
California's education sector is a target right now. A credential-driven breach at the state's testing contractor and a ransomware claim against the statewide school boards body have come within two weeks of each other. Even without a link between them, together they give attackers plenty to work with. Phishing that pretends to be from CDE, ETS, school districts or CSBA is easy to make convincing while families and administrators are expecting breach letters. Keyes Union's superintendent has already warned families about unexpected emails, texts and calls asking for personal details.
CSBA's position makes the claim matter more. The association talks regularly with board members and superintendents at nearly every district in the state. If real, stolen CSBA correspondence and contact lists would let attackers send convincing emails, pretending to be CSBA, to the people who approve district budgets and IT contracts.
The pattern is also familiar. In the ETS case, CDE says the cause was one compromised login. In the CSBA case, QPulse's account points to infostealer infections and hundreds of leaked passwords. In both, a stolen credential, not some new exploit, looks like the most likely way in.
The Attack Technique
No one has confirmed how Booba Project got into CSBA. The evidence QPulse cites points to stolen credentials:
- Infostealer infections. HudsonRock links two CSBA-associated accounts to the Cavalier stealer. Infostealers pull saved browser passwords, session cookies and autofill data from infected machines, often personal or shared devices. Criminals then sell those logs or use them directly.
- Exposed passwords and cookies. ParanoidLab's count of 417 passwords (20 critical) and 2 cookies matters because stolen session cookies can let an attacker skip multi-factor authentication by reusing a session that has already logged in.
- Cloud and SaaS footprint. QPulse says CSBA uses services including 1Password, Microsoft 365 and Zoom. Infostealer logs often contain logins for exactly these kinds of platforms. A stolen password-manager or Microsoft 365 session can open up far more than one account.
This is the same kind of entry point CDE confirmed for ETS: one compromised login used over almost four months without being detected. Whether CSBA was breached this way is still unproven.
What Organizations Should Do
- Check infostealer exposure now. Search commercial infostealer feeds and breach monitoring services for your domains. For every hit, reset the password, revoke active sessions and tokens, and reimage the infected device. A password reset alone leaves stolen cookies working.
- Make MFA resistant to session theft. Use phishing-resistant MFA (FIDO2/passkeys) for email, SFTP, VPN and admin accounts. Shorten session lifetimes, and bind sessions to the device or require compliant devices so a replayed cookie fails.
- Lock down file transfer systems. Audit every SFTP and managed file transfer account. Remove dormant and shared logins, restrict access by IP or require a VPN, and alert on bulk downloads or logins at unusual hours. The ETS attacker was active for nearly four months before being caught.
- Keep personal devices away from work logins. Infostealers mostly infect unmanaged home machines. Block access to Microsoft 365, password vaults and admin consoles from devices you don't manage, and stop staff saving work passwords in personal browsers.
- Warn staff, board members and families about follow-on phishing. Districts and education associations should send a short notice saying that CDE, ETS and CSBA will not ask for passwords or payment by email, text or phone. Point people to official pages such as cde.ca.gov/ets.
- Watch the leak site and your third parties. Organisations that deal with CSBA should watch for any data release by Booba Project, assume shared correspondence could be exposed, and check vendor contracts for breach-notification timelines. Districts heard about the ETS breach two weeks before the public did.
Sources: Booba Project Ransomware Group Claims 80GB Data Theft from Californ... | California warns all public school students of data stolen in contr... | One Compromised Login Exposed Millions of California Students' Reco... | State assessment contractor reports student data security incident... | Hackers Steal Personal Data of Millions of California Students in M... | Statewide Data Breach Notification IUSD.org | Statewide Data Security Incident Keyes Union School District | California state testing data breach may impact millions of student...