ETS Data Breach: California Student Data Exposed

The California Department of Education (CDE) says a data breach at testing contractor ETS (Educational Testing Service) exposed student records collected through the state's school assessment programs, after an intruder used a stolen login to copy files from ETS's file-transfer system between May and September 2026. ETS and CDE began notifying affected students and families on October 16, 2026, and are offering two years of free identity-protection coverage through Experian. Here is what the official notices say was exposed, who is affected, and how to enroll in the free protection before the deadline.

What happened

According to ETS's official Notice of Data Breach, published by CDE, an unauthorized party used a compromised login credential to get into a secure file transfer protocol (SFTP) site that ETS operates to exchange California statewide assessment data with CDE. Using that access, the intruder copied files containing California student information "at various times" between May 22, 2026, and September 18, 2026.

ETS says it identified the unauthorized activity on September 25, 2026. The company disabled the compromised account, took the affected SFTP site offline, and brought in outside cybersecurity experts to investigate. Law enforcement was also notified, though ETS says those investigations did not delay the notice to families.

ETS is a nonprofit organization under contract with the State of California to administer required state and federal testing, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC). That contract is why the company holds detailed student records for California's public schools in the first place.

Timeline of the incident

What student data was exposed

ETS says the information involved varies by individual and covers students enrolled in California public schools during the three previous school years. Per the official notice, the data that may have been accessed and copied includes:

• Student name, date of birth, residential address, school, district, and grade level
• Statewide Student Identifier (SSID) and local student identifier
• Gender, race or ethnicity, primary language, country of origin, and English-learner status
• Disability and Section 504 status, testing accommodations, and primary disability type
• Eligibility status for Title I Part A, Title I Part C, McKinney-Vento, and Military Connected Student programs
• English language proficiency information and statewide assessment registration, participation, and results

Not every affected student had every category of data exposed — ETS's notice says the specific mix depends on what information the state's assessment systems held about that student.

What was not exposed

ETS's notice is explicit that several higher-risk categories of information were not part of this incident. The data did not include Social Security numbers, driver's license numbers, or passport numbers; financial account, credit card, or debit card information; or account passwords. The incident also did not involve parent or guardian personal information — only student records were affected.

How many students are affected

Neither ETS's notice nor CDE's October 16 press release states a specific total number of affected students or families. The notice describes the population as students enrolled in California public schools during the three previous school years, which encompasses a large share of the state's K-12 assessment population, but CDE and ETS have not put an official figure on how many individual records were copied. Various outside estimates have circulated online since the breach became public, but because the two agencies that issued the breach have not confirmed a specific count in their own notices, this article does not repeat an unverified number.

What ETS and the state are doing

ETS says it has built an entirely new SFTP site with enhanced security controls to replace the one that was compromised, and that it continues to evaluate additional security measures. The company says that after working with law enforcement and outside cybersecurity experts, it has taken steps intended to reduce the risk that the copied data is made publicly available, and that its ongoing web monitoring has not turned up evidence the data has been posted publicly.

On the state side, CDE and the State Board of Education say they are working with state cybersecurity experts "to assess the effect on California students and families." According to ETS's notice, the California Cybersecurity Integration Center (Cal-CSIC) is assisting with digital forensics and incident response, with additional support from the California Department of Technology and the California Governor's Office of Emergency Services. CDE and the State Board are also separately reviewing the incident and ETS's compliance with its data-security and contractual obligations under its state testing contract.

The free identity-protection offer

ETS is offering two years of identity-protection services through Experian IdentityWorks at no cost to affected current and former students. There is no charge to enroll and no credit card is required. Two different product tiers apply depending on the student's age:

• Minor Plus (for students under 18): A parent or legal guardian enrolls on the student's behalf at experianidworks.com/minorplus using the activation code printed in the family's individual notification letter. This tier includes a Social Security number trace, internet/dark-web surveillance, identity restoration support, ExtendCARE post-membership support, and $1 million in identity theft insurance.
• Adult (for students 18 or older): Affected adults enroll directly at experianidworks.com/identity using their own activation code. This tier includes internet/dark-web surveillance, identity restoration support, ExtendCARE, and $1 million in identity theft insurance, but not a Social Security number trace.

Identity restoration assistance is available immediately to enrolled members and does not require taking any other action first. Families who would rather enroll by phone, or who have questions about the product, can call Experian's dedicated support line.

A discrepancy in the enrollment deadline — read carefully

ETS's official breach notice, as filed with the California Attorney General, is not fully consistent about the adult enrollment deadline, and it's worth flagging rather than glossing over. In the general summary near the top of the notice, ETS states that both the minor and adult identity-protection offers must be activated "on or before the enrollment deadline on March 19, 2027." The notice also tells both minors and adults to call Experian's customer care line "by March 19, 2027" for restoration help or an offline alternative to enrolling online.

However, in the detailed, step-by-step instructions specifically for students 18 and over, the notice separately states: "Ensure that you enroll by March 19, 2029 (Your code will not work after this date)." The minor enrollment instructions, by contrast, consistently list March 19, 2027 in both the summary and the detailed steps.

ETS's notice does not explain or reconcile this difference, so Pandromeda cannot say with certainty which date controls for adult enrollment specifically. Given the inconsistency, affected adults should not assume they have until 2029 — the safer approach is to enroll before March 19, 2027, the date that appears most consistently across the notice, or to contact Experian's support line directly to confirm an individual deadline using the engagement number printed on their letter.

Proposed class-action lawsuit

A proposed class-action lawsuit was reportedly filed against ETS on October 17, 2026, in the U.S. District Court for the Central District of California, in the days immediately following CDE's public disclosure of the breach. It is important to be precise about what that filing represents: it contains allegations made by plaintiffs' attorneys, no class of plaintiffs has been certified, and ETS has not been found liable for anything in connection with the suit. The claims in that filing are unproven allegations, not established facts, and this article does not treat them as such.

What affected families should do now

For families who receive a notification letter from ETS, the official guidance is straightforward:

• Enroll in the free identity-protection offer using the activation code in your letter, well before the stated deadline, especially given the deadline inconsistency described above.
• Watch for phishing attempts that reference the breach, a student's school, or statewide testing. ETS's notice specifically warns families to double-check URLs before entering any personal information, since scammers sometimes stand up fake "identity protection" sites after a breach like this becomes public.
• Consider a credit freeze for affected minors. California families can get a free security freeze for children under 16 from each of the three major credit bureaus, which makes it harder for anyone to open new accounts using a child's identity.
• Review the resources at the California Department of Justice's Privacy Unit page, which links to additional identity-theft guidance, consumer privacy resources, and the state's data breach reporting process.
• Keep records of your engagement number and any correspondence from ETS or Experian, in case you need to file a fraud dispute later.

Families who are also weighing broader identity-monitoring options beyond the free ETS offer — for example, once the two years of complimentary coverage runs out — can compare ongoing subscription services in Pandromeda's comparison of LifeLock, Aura, and Identity Guard. The ETS incident is also the latest in a string of large organizations that have had to notify people after attackers got into file-transfer or vendor systems; Pandromeda has previously covered how Burger King Japan disclosed a breach of customer records and how a utility notified customers after the CenterPoint Energy data breach affected more than a million Texans.

CDE says it will keep updating its ETS incident page as more information becomes available, and that the breach notice itself is posted in more than two dozen languages for California's diverse family population. For now, the clearest official guidance remains: enroll in the free protection, watch for phishing, and call the dedicated support line with any questions about a specific letter or engagement number.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage