Last updated: October 20, 2026
The quick answer
ETS, the company that runs California’s statewide school tests, says someone used a stolen login to copy student files from its file-transfer site between May 22 and September 18, 2026. Names, birth dates, home addresses, student ID numbers, demographics and test records were involved, but not Social Security numbers, financial details or parent information. Families should watch for a notice from ETS, enroll in the free two-year identity protection by March 19, 2027, and be wary of school-themed scam messages.
What happened
Educational Testing Service (ETS) administers California’s CAASPP and ELPAC assessments under a state contract. According to the California Department of Education (CDE), an unauthorized party used a compromised login credential to access a secure file transfer (SFTP) site that ETS and the state use to exchange assessment data, and copied files at various times over nearly four months. ETS spotted the activity on September 25, disabled the account, took the site offline and brought in outside security experts and law enforcement.
CDE told school districts on October 2 and announced the breach publicly on Friday, October 16. SecurityWeek reports that letters and emails to students and families began the same day and are expected to continue into early November. ETS says its web monitoring has found no sign so far that the data has been published. Officials have not said how the credential was stolen or who was behind the intrusion, and the state is reviewing whether ETS met its contract’s security requirements.
| May have been exposed (varies by student) | Not involved, per CDE |
|---|---|
| Name, date of birth, home address | Social Security numbers |
| School, district and grade level | Driver’s license or passport numbers |
| Statewide and local student ID numbers | Financial account or payment card data |
| Gender, race or ethnicity, primary language, country of origin | Account passwords |
| Disability, Section 504 and testing accommodation details | Parent or guardian personal information |
| Program eligibility (such as Title I, McKinney-Vento, military-connected) | |
| English proficiency, test registration, participation and results |
What changes for you
The absence of Social Security numbers lowers the immediate risk of someone opening credit in a child’s name, but the data is still sensitive. A name, birth date, address and school is exactly what a scammer needs to sound convincing in a call, text or email that claims to be from the school, the district or “the testing company.” Children’s identities are also attractive to fraudsters because problems can go unnoticed for years, until the child applies for a loan or a job.
Some of the exposed fields, such as disability status and program eligibility, are private by nature. There is nothing a family can do to change those records, which is why limiting follow-up fraud is the realistic goal.
What to do now
- Look for the notice. ETS is sending letters and emails, in multiple languages, with an activation code. Not receiving one doesn’t mean a student is unaffected, especially if your address changed.
- Enroll in the free protection. ETS is paying for 24 months of Experian IdentityWorks, with no credit card required. Parents enroll children under 18 in the Minor Plus product; former students who are now adults use the adult product. The enrollment deadline for both is March 19, 2027.
- Call the helpline if you have no letter. The dedicated line is 833-931-8488, Monday to Friday, 6 a.m. to 6 p.m. Pacific. Use engagement number B174774 for students under 18 or B174775 for those 18 and older.
- Consider a credit freeze. Adults can freeze their own credit files for free with Equifax, Experian and TransUnion. CDE notes parents can also request a free freeze for children under 16.
- Treat school-related messages with caution. Don’t share Social Security numbers, passwords or bank details in response to unexpected calls, texts or emails, even if they mention your child’s school or test scores. Verify through CDE’s official breach page or your school directly.
- Check your own credit reports through AnnualCreditReport.com if you’re a former student who is now an adult.
Scammers often piggyback on breach news. Our guide to election-season scams covers the same warning signs, and our More Rewards breach guide walks through similar protective steps.
Who is affected, and who isn’t
Possibly affected: current and former students enrolled in California public schools in the three previous school years and the current one, according to CDE, plus students who left a California school since 2006 without a confirmed transfer to another school. CDE notes that former students who are now adults may be included. No official total has been released; for scale, California public schools enrolled more than 5.7 million students in 2025-26.
Not affected: parents and guardians’ own personal information, according to CDE, and students outside California’s public school system, such as those who only attended private schools.
FAQ
Is the ETS email or letter real?
ETS is sending notices at the state’s direction. If in doubt, don’t click links; compare the details with CDE’s official ETS incident page or call the helpline number listed above.
My child turns 18 soon. Which product should we use?
CDE says affected minors who turn 18 before March 19, 2029 can enroll in the adult product using the activation code from their notification.
Has the data been leaked online?
ETS says its monitoring hasn’t found it published so far. That can change, so enrolling in the free monitoring is still worthwhile.
Leave a Reply