Key facts
- Educational Testing Service (ETS), a nonprofit that works with the California Department of Education on statewide student assessments, experienced a data breach involving student records.
- The intruder copied files with student information at different times from May 22 to Sept. 18, 2026.
- The compromised information includes records for all students who were enrolled over the previous three school years.
- The state identifies former students; some left California public schools, the department never confirmed their transfers, and some left as far back as 2006.
An intruder used a stolen credential to access an ETS-run secure file transfer site and copy records for millions of California students from May 22 to Sept. 18, 2026, and ETS found the activity on Sept. 25.
ETS is a nonprofit that partners with the California Department of Education on statewide student tests, and the breach was limited to California assessment data. ETS told CyberGuy that no other customers were affected by the incident.
The stolen files may include student names, home addresses, birth dates, school districts, grade levels, school names and Statewide Student Identifiers. Demographic details potentially exposed include race, ethnicity, primary language, country of origin and English learner status. The files may also show whether students took part in educational assistance programs, including programs for children experiencing homelessness, and include statewide assessment participation and test results. The exposed data may also cover disability information, Section 504 statuses, types of primary disability, testing accommodations and special education accommodations, and no Social Security numbers, financial account information, driver’s license numbers, passwords or parent and guardian details were involved, according to state and ETS notices.
The breach may affect millions of current and former students, including California public school students whose families now live outside the state. Records cover all students who enrolled over the previous three school years, and the state has identified former students, some of whom left as far back as 2006. Roughly 5.7 million public school students are in California, and breach reporting estimates that the breach affected 5.7 million students for the 2025-2026 academic year, when more than 5.7 million students enrolled. Officials have not released a final count of unique affected individuals.
On Sept. 25, ETS found the suspicious activity, disabled the account, shut down the site and brought in outside cybersecurity specialists. Investigators confirmed that someone accessed and copied the records, and ETS says it has found no evidence that anyone released the stolen information publicly. The site relies on secure file transfer protocol to share California assessment data with the state.
ETS constructed a replacement system with stronger security controls and keeps watching for signs that the stolen information has appeared publicly. The company added extra protections, including enhanced monitoring, stronger access controls and additional third-party review of security practices. ETS said in a statement to CyberGuy, “We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices.”
State education officials are coordinating with cybersecurity specialists and other state agencies on the response, and the California Cybersecurity Integration Center is helping with the technical investigation. State officials are examining ETS’s contractual obligations and compliance with applicable data security requirements. The state education bodies joined forces with state cybersecurity partners to investigate the breach.
ETS started notifying affected students and families on October 16, 2026, and the state expects notifications to continue through early November. Notification letters and e-mails explain what occurred, identify the information involved and include details for accessing complimentary identity-protection services. The breach notice and frequently asked questions appear in 27 languages on the California Department of Education website at cde.ca.gov/nr/in/ets-incident.asp. Officials caution that not receiving a notification does not necessarily mean a person’s information is safe, since former students sometimes have outdated contact information on file.
ETS is offering affected current and former students free identity theft protection for 24 months, and enrollment is free and requires no credit card. Parents or legal guardians can enroll eligible children under 18, and adults, including former students, can enroll themselves by March 19, 2027. Eligible minors who turn 18 before March 19, 2029 can qualify for adult coverage with the activation code in their notification. Eligible individuals can receive identity restoration assistance for 24 months from their notification date without signing up for monitoring.
Families can reach the incident assistance line at 833-931-8488 on weekdays from 6 a.m. to 6 p.m. Pacific Time. They should verify any breach notification before responding, since scammers may send fraudulent e-mails claiming to come from ETS or Experian. Parents can request a free credit freeze for children under 16 by contacting Equifax, Experian and TransUnion separately, and teenagers ages 16 and 17 can request their own freezes the same way. Adults who may have been affected can review credit reports for unfamiliar accounts at AnnualCreditReport.com and report identity theft through IdentityTheft.gov, and they can ask their child’s school district what information outside contractors receive and how long it is retained.
Join the discussion