Yu Ming Charter School is listed on the California Attorney General’s data breach site with a notice about a data security incident at Educational Testing Service (ETS), the nonprofit that runs California’s statewide student assessments. The notice says an unauthorized party accessed and copied student information.
The filing was reported to the Attorney General on November 4, 2026. It describes a breach at a state testing vendor rather than at the school’s own network, which is why the notice reads as a statewide notice to students and families.
Yu Ming Charter School’s Data Breach Investigation
The notice posted under Yu Ming Charter School’s name is titled Notice of Data Breach, and it is written by ETS at the direction of the California Department of Education. ETS is a nonprofit assessment organization with a contract with the State of California to provide required testing to students in California public schools. It supports the California Assessment of Student Performance and Progress and the English Language Proficiency Assessments for California. The California Attorney General’s breach list carries a reminder that the organization that sends a notice is not always the one that experienced the breach, and that appears to be the situation here.
According to the notice, ETS identified unauthorized activity involving a secure file transfer protocol site on September 25, 2026. The site was used to exchange statewide assessment information with the California Department of Education. ETS says it disabled the account involved, took the affected site offline, and began an investigation with outside cybersecurity experts. The investigation found that an unauthorized party used a compromised login credential at various times between May 22, 2026 and September 18, 2026 to access the site and copy files that held California student information.
The notice says the information of California students was accessed and copied, including but not limited to students enrolled in the three previous school years. That wording points to a very large group of current and former students across the state, but the notice does not give a total number of people affected, and it does not say how many students at Yu Ming Charter School were involved. Public reporting on the incident says ETS asked local education agencies to voluntarily help deliver the notice to students and parents, because it does not have their email addresses. A school may therefore appear in the Attorney General’s records simply because it distributed the notice.
ETS says it has taken steps to improve security, including taking the affected site offline and building an entirely new file transfer site with stronger controls. It says it worked with law enforcement and cybersecurity experts to reduce the risk that the data is made public, and that its regular web monitoring has not found evidence that the information has been made public. The California Department of Education and the State Board of Education say they are working with state cybersecurity experts on the response, and that they are reviewing the incident and ETS’s compliance with data security and contract requirements. The California Cybersecurity Integration Center is assisting with digital forensics and incident response, with support from the California Department of Technology and the Governor’s Office of Emergency Services.
As a response, ETS is offering two years of identity protection services through Experian IdentityWorks at no cost. There is one package for students under 18, which a parent or guardian can activate, and one for former and current students who are now adults. The notice sets an enrollment deadline of March 19, 2027. No credit card is needed to enroll. The California Department of Education has set up a web page with updates and says the notice is available in multiple languages, and ETS lists a toll-free call center for questions.
Anyone who receives this notice should read it closely. The information described is student data, not payment data, but records tied to a child can carry long-term risk. Names, birth dates, home addresses, and school details can be used in phishing messages that look believable because they mention a real school or a real test. The notice itself warns families to be careful with unexpected emails, texts, and phone calls that mention a student’s school, statewide assessments, or this incident, and to double check web addresses before entering any information on a site that claims to offer identity protection.
Because the notice does not state how many students were affected or exactly which records belong to which school, the full scope remains unclear. This page reports only what the notice and the public filing say, and it will not guess beyond them.
When Did This Breach Occur?
According to the notice, an unauthorized party used a compromised login credential at various times between May 22, 2026 and September 18, 2026 to reach the file transfer site and copy files. ETS says it identified the unauthorized activity on September 25, 2026.
The incident was reported to the California Attorney General on November 4, 2026. The California Department of Education has said that distribution of the notice began on October 16, 2026.
What Information Was Breached?
The notice says the information varies by person and may include a student’s name, date of birth, residential address, school, district, and grade level, along with a Statewide Student Identifier and a local student identifier. It may also include gender, race or ethnicity, primary language, country of origin, and English learner status.
Other information named in the notice includes disability and Section 504 status, testing accommodations, and primary disability type, plus eligibility status for Title I, McKinney-Vento, and Military Connected Student programs. English language proficiency information and statewide assessment registration, participation, and results may also be involved.
The notice states that Social Security numbers, driver’s license numbers, passport numbers, financial account information, credit or debit card information, and account passwords were not part of the accessed data, and that parent or guardian information was not involved.
What You Can Do
If you received this notice for yourself or for your child, consider the following steps.
- Enroll in the free Experian IdentityWorks services using the activation code in your notice before the March 19, 2027 deadline. Parents or guardians can enroll students under 18.
- Treat unexpected emails, texts, and calls that mention your child’s school, state testing, or this incident with caution, and never share passwords or financial details in response to them.
- Check web addresses carefully before entering information on any site that claims to offer identity protection, since fake sites copy real offers.
- Consider placing a free security freeze on your credit file and on your child’s file, and review free credit reports at annualcreditreport.com.
- Review the updates and the notice in your language on the California Department of Education web page referenced in the notice, and keep a copy of your notice.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov and to the California Attorney General at oag.ca.gov/privacy.
File a Data Breach Lawsuit Against Yu Ming Charter School
People whose personal information is exposed in a data security incident may have legal options if the organization failed to use reasonable safeguards to protect it. Whether a claim exists depends on the facts, including what information was involved, how the incident happened, and how the organization responded.
If you received a notice connected to Yu Ming Charter School, or you believe your child’s information was involved, you can speak with a lawyer about whether you may be able to join a class action lawsuit to seek compensation for the exposure of that information, the time you spent responding, and any losses you suffered.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
