Notices began going out to California families on October 16 telling them that a student’s school records had been copied from a testing contractor’s file server. The ETS data breach involves Educational Testing Service, which runs California’s statewide tests, and a single compromised login that, according to the state’s notice, was used on and off “from May 22, 2026 to September 18, 2026” to copy student files.
Where it stands: Notices are still going out and, per SecurityWeek, the California Department of Education (CDE) expects them “to continue into early November.” No victim count has been released. ETS says routine web monitoring has, “to date, not uncovered any evidence that the information has been made public.”
What happened in the ETS data breach
ETS is the nonprofit that administers California’s state-required assessments, such as the CAASPP and ELPAC tests. It swaps data with the state through a secure file transfer (SFTP) site. The sample notice ETS filed with the California Attorney General gives the discovery date: “On September 25, 2026, ETS identified unauthorized activity involving an SFTP site used to exchange California statewide assessment information with CDE.”
Look at the dates together. The intruder’s first visit was in late May and the last in mid-September, and the unusual activity was only spotted afterwards. SecurityWeek summed it up: the organization “spotted unauthorized activity on the site on September 25, but the earliest access dates back to late May.”
ETS says it “disabled the account involved, took the affected SFTP site offline, and initiated an investigation with the assistance of external cybersecurity experts.” It has since built a replacement file-transfer site. What nobody has explained is how the credential was stolen. SecurityWeek notes the official disclosures “do not explain how the login credential was compromised, and they do not identify the attacker.”
Which student records were copied
This is a test-data breach, so the records are about students’ schooling rather than their finances. The notice says details vary by student but may include:
| Category | Examples from the notice |
|---|---|
| Identity | Name, birth date, home address, school, district, grade |
| Student IDs | State SSID and local student ID |
| Demographics | Gender, race or ethnicity, language, country of origin |
| Special education | Disability and Section 504 status, accommodations |
| Programs | Title I, McKinney-Vento, military-connected status |
| Testing | Registration, participation and results |
The program list deserves a second look. The notice includes “Eligibility status for the following programs: Title I, Part A; Title I, Part C; McKinney-Vento; and Military Connected Student.” McKinney-Vento covers students experiencing homelessness and Title I, Part C covers migrant students, so for some families the leak reveals circumstances they may never have shared outside school.
SecurityWeek flags the same sensitivity: some entries reveal “disability and Section 504 status, the primary disability type, testing accommodations, English proficiency data, and test registration and results.”
What was not in the files
The notice is direct on this point: “The data accessed and copied did not include Social Security numbers, driver’s license numbers, passport numbers, financial account information, credit or debit card information, or account passwords.” Malwarebytes adds that “parent or guardian information” was not involved either.
That shapes the risk. Without a Social Security number, opening credit in a child’s name is much harder. The bigger concerns are privacy, since disability status and program eligibility have been copied by an unknown party, and scams that use a child’s real name, school and grade to sound official.
How many students: what we know and do not know
There is no official total. The notice says only that “Information about California students, including but not limited to all students enrolled in the three previous school years, was accessed and copied.” The words “not limited to” mean some former students from earlier years may also be in the data.
You may see large estimates online. For scale only, Malwarebytes cites CDE figures showing “over 5.7 million students were enrolled in California public schools during the 2025-2026 school year alone.” That is an enrollment number, not a count of victims, and it should not be read as one.
How to claim the free identity protection
ETS is paying for two years of Experian IdentityWorks. There are two versions, one for minors and one for former students who are now adults. The notice explains the deadline for children: “A parent or legal guardian can enroll the student in the available minor identity-protection services on or before the enrollment deadline on March 19, 2027.” It also states, “There is no cost to you to enroll, and no credit card information will be requested.”
The minor plan includes a check for whether a credit file exists in your child’s name, which is a good early warning even when no Social Security number leaked. The activation code and engagement number are printed in your letter, so keep it somewhere safe.
Questions go to the number in the notice: “please call 833-931-8488, Monday through Friday, 6:00 am to 6:00 pm Pacific Time, excluding major U.S. holidays.” CDE also keeps an incident page at cde.ca.gov/ets, which the notice names as the place for updates and translated copies.
What parents should do now
- Enroll before the deadline. Use only the web address printed in your letter. ETS itself warns: “Be cautious of fake identity protection sites by double checking URLs before providing information.”
- Brief older kids. Teenagers who read their own email are likely targets for messages about test scores or college applications. The notice urges caution with “unexpected emails, text messages, or phone calls that reference a student’s school, statewide assessments, or this incident.”
- Never send sensitive details on request. CISA lists “Requests to send personal and financial information” among the classic signs of phishing. A real school office will not ask you to text a Social Security number.
- Consider a child credit freeze. It is not essential here because no Social Security numbers were taken, but it is free, and the notice reminds families, “You also can get a free freeze for your children who are under 16.” See our guide on protecting children from identity theft.
- Ask your district what it shares. Our explainer on how to protect your child’s school records covers the questions worth putting to a school about outside vendors.
The state is also looking at the contractor. According to the notice, “CDE and SBE are also reviewing the incident and ETS’s compliance with applicable data security and contractual requirements,” with the California Cybersecurity Integration Center helping on the forensic side.
Frequently Asked Questions
Was my child’s Social Security number exposed in the ETS data breach?
No, according to the notice. ETS says the copied files did not include Social Security numbers, driver’s license or passport numbers, financial account or card information, or account passwords, and that no parent or guardian information was involved.
How many students were affected by the ETS breach?
No official count has been released. The notice says the copied data covers at least every student enrolled during the last three school years, and possibly some earlier students too. Figures circulating online are estimates, not an official victim count.
How do I sign up my child for the free ETS identity protection?
ETS is offering two years of Experian IdentityWorks at no cost. A parent or legal guardian enrolls a student under 18 using the code in the notice letter, on or before March 19, 2027. Adults who were affected as former students can enroll themselves.
Is the ETS breach notice email a scam?
The real notice is genuine, but copycats are likely. Check it against the California Department of Education’s incident page at cde.ca.gov/ets, which ETS names as the official source, and never give a Social Security number to someone who calls about the breach.
What is the ETS phone number for the California student data breach?
The notice lists 833-931-8488, staffed on weekdays from early morning to early evening Pacific Time, except on major holidays. Have the engagement number from your letter ready.
Sources
- Notice of Data Breach (ETS, at the direction of the California Department of Education) — Educational Testing Service, sample notice filed with the California Attorney General, listed October 16, 2026
- One Compromised Login Exposed Millions of California Students’ Records — SecurityWeek (Eduard Kovacs), not shown on cached page (after October 16, 2026)
- Millions of California students’ sensitive data stolen in breach — Malwarebytes (Pieter Arntz), October 19, 2026
- Recognize and Report Phishing — Cybersecurity and Infrastructure Security Agency (CISA), undated archived guidance page, retrieved October 22, 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.