The Educational Testing Service (ETS), the nonprofit that administers California’s statewide assessments such as CAASPP and ELPAC, suffered a massive data breach that affected nearly 7 million public-school students. Between May 22 and September 18, 2026, an unauthorized actor used a compromised credential to infiltrate ETS’s secure file-transfer site and copy student files. The intrusion remained undetected for almost four months, only coming to light when ETS identified unusual activity on September 25, 2026. The California Department of Education (CDE) subsequently informed school districts on October 2 and began public notifications on October 16.
The breach encompasses students enrolled in California public schools from the 2023 academic year onward, as well as individuals who left the state system after 2006 without a documented transfer. Consequently, a portion of the victims are now adults. Although Social Security numbers and financial account details were not part of the stolen material, the exposed information—names, birth dates, home addresses, school identifiers, disability status and test results—provides a detailed profile that could be exploited for fraudulent student-loan applications or sophisticated phishing attacks.
How the breach unfolded and the investigative response
ETS relies on an SFTP site to exchange assessment data with the CDE. The attacker gained entry by exploiting a compromised login credential, though the method of acquisition remains undisclosed. Once inside, the intruder intermittently copied files over the four-month window. Upon discovery, ETS immediately disabled the offending account, removed the SFTP site from service, and engaged external cybersecurity specialists and law-enforcement agencies to conduct a forensic review. The agency also retired the old transfer system and erected a new, more tightly controlled platform with assistance from the California Cybersecurity Integration Center (Cal-CSIC).
Both ETS and the CDE assert that, to date, there is no evidence that the harvested data has been posted publicly or sold on dark-web forums. However, investigators continue to monitor online channels for any signs of publication. The CDE has pledged to evaluate whether ETS satisfied the data-security obligations stipulated in its state contract, echoing the department’s statement: “we expect our contractors to uphold the highest standards”.
What information was exposed and its potential impact
The extracted files contain a broad spectrum of student-specific details. Basic identity fields include full name, date of birth and residential address. School records reveal the institution, district, grade level and both state and local student IDs. Demographic data such as gender, race or ethnicity, primary language, country of origin and English-learner status were also taken. Moreover, the breach disclosed disability information (Section 504 status and accommodation needs) and eligibility for programs like Title I, McKinney-Vento and military-connected benefits. Test-registration data and actual assessment results were part of the leak as well.
Crucially, the dataset omitted government identifiers—no Social Security, driver’s license or passport numbers—plus no financial or parent-guardian data. While the absence of SSNs makes classic credit fraud more difficult, the combination of name, birth date and address still furnishes thieves with the core ingredients for identity theft, especially for forging student-loan applications or constructing convincing phishing messages that reference a real school and grade level.
Resources offered to families and steps to protect against misuse
ETS has funded a two-year subscription to Experian IdentityWorks for all affected families. Minors can enroll through the Minor Plus product, while individuals who are now adults may use the standard IdentityWorks plan. Activation codes were included in the notification letters, and enrollment must be completed by March 19, 2027. In addition, parents of children younger than 16 can request free credit freezes from the three major bureaus—Equifax, Experian and TransUnion—without charge. Adults who were once students can obtain complimentary credit reports via .
The CDE advises families to treat any unsolicited communication citing the breach with extreme caution. Recipients should never furnish Social Security numbers, passwords, or banking details in response to unexpected emails, texts or phone calls. Instead, they should contact the official helpline at 833-931-8488 to verify legitimacy. For former students who have moved and may not receive a mailed notice, the department encourages calling the line to confirm whether their data was included.
Robert Farrington, founder of The College Investor and a long-time commentator on student-loan issues, warns that the breach could remain invisible until a teenager attempts to open a credit card or apply for a private loan. “A credit file created under a child’s name is a red flag, but most families never check for one,” he notes. Farrington emphasizes that early detection—through the free monitoring service or credit-freeze request—offers the best chance to thwart fraudulent activity before it escalates.
As the investigation proceeds, state officials will release an official count of affected students and outline when paused testing activities are expected to resume. Until then, the combination of vigilant monitoring, credit freezes and awareness of phishing tactics remains the primary defense for the millions whose educational records were compromised.
