Security Guides

#data breach #education #student data #children #phishing #United States

ETS California Student Data Breach: Disability, 504 and Test Data Copied, and What Families Should Do

ETS says California student data from statewide testing was accessed and copied, including disability and 504 status. What was involved and what to do.

Published 2026-10-31 Updated 2026-10-31 Last verified 2026-10-31 12 min read

On this page

For: families of current and former California public school students, former students who are now adults, and schools and vendors that hold student records. This article is based on ETS's Notice of Data Breach filed with the California Attorney General and CDE's announcement, and does not cover attack techniques.

Bottom line

assume the notice covers your child, enroll with the code in the letter, and do not trust messages that mention the school

According to ETS, files from its statewide testing data exchange were accessed and copied, including disability and Section 504 information. Social Security numbers, card data and passwords were not included, ETS says.

If your child attended a California public school in the last three school years, assume the notice applies
Enroll in the free Experian IdentityWorks with the code in your letter; type the address in yourself
Do not trust calls or messages because they mention the school, grade, test results or student ID
Disability and accommodation details cannot be changed, so be careful about who you discuss them with
Schools and vendors: list which systems hold student disability data and who can log in to them

Developing: this article will be updated as the organisation publishes more

Who is affected: families of current and former California public school students, former students who are now adults, and schools and vendors that hold student records.
Confirmed so farSee the table ↓: Period of access
Who is covered
Name, date of birth, address, school, district, grade
5 more
SSID and local student ID
Gender, race or ethnicity, language, country of origin, English learner status
Disability and Section 504 status, testing accommodations, primary disability type
Program eligibility (Title I, McKinney-Vento, Military Connected)
English proficiency and test registration, participation and results
Not yet confirmed: Number of students affected
How far back the copied records go
How the login credential was compromised
2 more
Whether the data is ever made public
Outcome of CDE and the State Board of Education's review
What to do nowSee the steps ↓: Treat the notice as applying to your child
Enroll in the free Experian IdentityWorks with the code in your letter
Do not trust calls or messages because they mention the school or tests
2 more
Be careful about who you discuss disability and accommodation details with
A credit freeze for your child is optional, not required by the notice
Where to verify (source)All sources ↓: ETS, "Notice of Data Breach" (sample filed with the California Attorney General, PDF)
Last checked: As of October 31, 2026

Follow-up plans and what we checked

CDE says its ETS incident page will be updated if additional information becomes available. As of October 31, 2026, ETS and CDE have not published a count. CDE said notices began on October 16 and were expected to continue through early November.

What families and former students should do today

Treat the notice as applying to your child

The notice says information about California students, including but not limited to all students enrolled in the three previous school years, was accessed and copied. ETS runs the state-required tests for students in California public schools. If your child attended one in that period, or you did yourself, assume you are covered even before a letter arrives.

To check, use CDE's page at cde.ca.gov/ets, which you type into the browser yourself, or call the number in the notice (833-931-8488, Monday to Friday, 6:00 am to 6:00 pm Pacific Time, excluding major US holidays). The notice is available in multiple languages on CDE's page.

Enroll in the free Experian IdentityWorks with the code in your letter

ETS offers two years of Experian IdentityWorks at no cost. For students under 18, a parent or guardian enrolls them in the minor product. Students who are now 18 or older enroll themselves in the adult product. The activation code is in the letter, and no credit card is requested.

The notice gives March 19, 2027 as the enrollment deadline in its main text (the adult attachment also shows March 19, 2029). Minors who turn 18 by March 19, 2029 may enroll in the adult product on their 18th birthday. ETS warns about fake identity-protection sites: type the Experian address printed in your letter yourself rather than following a link in an email or text.

Do not trust calls or messages because they mention the school or tests

The copied data can include the school, grade, student identifiers and test results. A message that quotes them can look genuine. ETS says to be cautious of unexpected emails, texts or calls that reference a student's school, statewide assessments or this incident, and not to share personal information, passwords or financial information in response.

If a message asks you to "confirm" your child's details or pay for something, close it and call the school or district on a number from its official website (how to spot these: What is phishing?).

Be careful about who you discuss disability and accommodation details with

The data can include disability and Section 504 status, testing accommodations and the primary disability type. These cannot be changed like a password. Be wary of anyone who contacts you first and refers to your child's disability, support plan or accommodations, for example offering services or asking for records. Confirm with the school before you share anything.

A credit freeze for your child is optional, not required by the notice

ETS says Social Security numbers were not included. The notice's general guidance still explains that you can freeze a child's credit file for free with Equifax, Experian and TransUnion if the child is under 16. This is a precaution you can choose; the notice does not say it is needed for this incident.

What happened (from ETS's notice)

The following is based on ETS's Notice of Data Breach, as filed with the California Attorney General, and CDE's news release of October 16, 2026. ETS is a nonprofit assessment organization under contract with the State of California for the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).

California Department of Education

Exchanges statewide assessment information with ETS

↓→

ETS's SFTP site

Accessed with a compromised login credential; files copied

↓→

Student records

Demographic, program, disability and test data

How the credential was compromised has not been published.

Where the copied files were held (per ETS's notice)

May 22 to September 18, 2026
According to ETS, an unauthorized party used a compromised login credential at various times in this period to access an ETS SFTP site used to exchange statewide assessment information with CDE, and copied files containing California student information.
September 25
ETS identifies the unauthorized activity. It disables the account involved, takes the SFTP site offline and starts an investigation with external cybersecurity experts.
October 16
ETS begins notifying students and families at CDE's direction. CDE publishes a news release; the California Attorney General's list shows the filing under "CDE" with a breach date of May 22, 2026.
Early November (expected)
CDE said notification distribution was expected to continue through early November.

About 4 months

Period the credential was used (May 22 to Sep 18)

3 school years

All students enrolled, at least (notice)

Not published

Number of students

2 years

Free Experian IdentityWorks

What ETS's notice says

Organization: Educational Testing Service (ETS), a nonprofit under contract with the State of California for state and federally required testing in public schools
System: An ETS SFTP site used to exchange statewide assessment information with CDE
Who: Information about California students, including but not limited to all students enrolled in the three previous school years
Items (vary by student): Name, date of birth, residential address, school, district, grade level; SSID and local student ID; gender, race or ethnicity, primary language, country of origin, English learner status; disability and Section 504 status, testing accommodations, primary disability type; eligibility for Title I Part A, Title I Part C, McKinney-Vento and Military Connected Student; English language proficiency information and assessment registration, participation and results
Not included (ETS): Social Security numbers, driver's license and passport numbers, financial account information, credit or debit card information, account passwords. Parent or guardian personal information was not involved
Public exposure: ETS says that, following regular web monitoring, it has to date not found evidence that the information has been made public, and that it took steps with law enforcement and experts to reduce that risk
Response: Account disabled, site taken offline, an entirely new SFTP site built with stronger security controls, law enforcement notified
State response: CDE and the State Board of Education are working with state cybersecurity experts; the California Cybersecurity Integration Center assists with forensics. CDE and the Board are also reviewing the incident and ETS's compliance with data security and contractual requirements

What is known and what is not

The state as of October 31, 2026. When ETS or CDE publishes more, the status column will be rewritten.

Item	What the notice says	Status
Period of access	Compromised login credential used at various times from May 22 to September 18, 2026	Confirmed (ETS)
Who is covered	California students, including but not limited to all students enrolled in the three previous school years	Confirmed (ETS)
Name, date of birth, address, school, district, grade	Copying of the files confirmed; this item may be included (varies by student)	Leak confirmed (ETS; items vary by student)
SSID and local student ID	May be included (varies by student)	Leak confirmed (ETS; items vary by student)
Gender, race or ethnicity, language, country of origin, English learner status	May be included (varies by student)	Leak confirmed (ETS; items vary by student)
Disability and Section 504 status, testing accommodations, primary disability type	May be included (varies by student)	Leak confirmed (ETS; items vary by student)
Program eligibility (Title I, McKinney-Vento, Military Connected)	May be included (varies by student)	Leak confirmed (ETS; items vary by student)
English proficiency and test registration, participation and results	May be included, where applicable	Leak confirmed (ETS; items vary by student)
Social Security, driver's license and passport numbers, financial and card data, passwords	Not included	Not included (ETS)
Parent or guardian information	Not involved	Not included (ETS)
Data made public	No evidence found to date through web monitoring	Not confirmed (ETS)
Number of students	Not given	Not stated
How the credential was compromised	Not given	Not stated

How to read this: press estimates of the count are not official

Some reports give estimates of how many students are affected, and the figures differ between outlets. ETS and CDE have not published a number, so this article does not use one. The words "including but not limited to" in the notice mean that students outside the three-year window may also be included.

What this combination of data can lead to

In general, combinations like the following can be misused. This does not mean it has happened here.

Name + school + grade + student ID: a convincing message posing as the school, the district or a testing program
Disability, 504 status and accommodations: approaches that play on a family's concerns, such as offers of paid services or requests for records
Address + date of birth: a starting point for impersonation, even without a Social Security number
The incident itself: fake "claim your protection" or "verify your child" messages that copy the look of the real notice

For schools and vendors that hold student records

The notice does not say how the login credential was compromised, so this section does not judge ETS's security. It covers what the disclosed facts let other organizations check.

Find systems where one login opens many students' files. Here a single account on a file exchange site gave access to files covering statewide students. List file transfer sites, shared folders and exports, and who holds accounts on them.
Watch for long-running access. The credential was used at various times over about four months before the activity was identified. Check that logins and downloads on file exchange systems are logged and reviewed.
Send only the fields the task needs. The files included disability and program details along with test data. Review whether each data exchange needs every field it carries.

Sources (public records)

The facts in this article are based on the public information below. Press estimates of the number of students are not used.

ETS, "Notice of Data Breach" (sample filed with the California Attorney General, PDF) — oag.ca.gov
California Attorney General, data breach list entry (organization "CDE", breach date May 22, 2026, reported October 16, 2026) — oag.ca.gov
California Department of Education, News Release #26-45, "ETS Begins Notifying California Students and Families Following Data Security Incident" (October 16, 2026) — cde.ca.gov
California Department of Education, ETS incident information page — cde.ca.gov/ets
US Federal Trade Commission, "Credit Freezes and Fraud Alerts" — consumer.ftc.gov

Update history

2026-10-31: First version. Based on ETS's Notice of Data Breach filed with the California Attorney General and CDE's October 16 news release. No count has been published. The article will be updated when ETS or CDE publishes more.

Latest breaking reports

All breaking reports →

FAQ

QWhat was involved in the ETS data breach?

According to ETS's Notice of Data Breach, the information accessed and copied varies by student but may include: name, date of birth, residential address, school, district and grade level; the Statewide Student Identifier (SSID) and local student identifier; gender, race or ethnicity, primary language, country of origin and English learner status; disability and Section 504 status, testing accommodations and primary disability type; eligibility for Title I Part A, Title I Part C, McKinney-Vento and Military Connected Student programs; and English language proficiency information and statewide assessment registration, participation and results.

QIs my child affected?

The notice says information about California students, including but not limited to all students enrolled in the three previous school years, was accessed and copied. ETS runs the state-required tests for students in California public schools. Former students who are now adults are also covered. ETS has not published a number. CDE said notices began going out on October 16 and were expected to continue through early November.

QWere Social Security numbers or passwords taken?

ETS says the data did not include Social Security numbers, driver's license numbers, passport numbers, financial account information, credit or debit card information, or account passwords, and that parent or guardian personal information was not involved.

QWhat caused it?

ETS says an unauthorized party used a compromised login credential to access an SFTP site that ETS used to exchange statewide assessment information with CDE. How the credential was compromised has not been published. ETS took the site offline and built a new one with stronger security controls.

QWhat if someone calls or emails about my child's school or test results?

ETS says to be cautious of unexpected emails, text messages or phone calls that reference a student's school, statewide assessments or this incident, and not to share personal information, passwords or financial information in response. Knowing the school, grade or student ID does not prove a caller is genuine. Check through CDE's page at cde.ca.gov/ets, which you type in yourself.

QHow do I get the free Experian protection, and is there a deadline?

ETS offers two years of Experian IdentityWorks at no cost: a minor product for students under 18, which a parent or guardian enrolls, and an adult product for students who are now 18 or older. The activation code is in the letter, and no credit card is requested. The notice gives March 19, 2027 as the enrollment deadline in its main text; the adult attachment also shows March 19, 2029. Enrolling before March 19, 2027 meets both. Minors who turn 18 by March 19, 2029 may enroll in the adult product on their 18th birthday. ETS warns to be cautious of fake identity-protection sites and to double-check URLs.