Educational Testing Service, known as ETS, is a nonprofit that administers California’s statewide student assessments under a state contract. It has notified California students and families that files containing student information were accessed and copied from one of its file transfer sites, at the direction of the California Department of Education.
Here is what the notice says, which information was and was not involved, and what you can do. Organizations entrusted with children’s records have a responsibility to protect them.
Educational Testing Service’s Data Breach Investigation
Educational Testing Service is a nonprofit assessment organization under contract with the State of California to provide state and federally required testing to students in public schools. Its work supports the California Assessment of Student Performance and Progress and the English Language Proficiency Assessments for California. The California Department of Education, often shortened to CDE, directed ETS to send the notice and posted it on its own website on October 16, 2026.
According to the notice, ETS identified unauthorized activity on September 25, 2026 involving a secure file transfer protocol site, often called an SFTP site, that ETS and CDE use to exchange statewide assessment information. ETS says it disabled the account involved, took the affected site offline and started an investigation with outside cybersecurity experts.
The investigation found that an unauthorized party used a compromised login credential at various times between May 22 and September 18, 2026 to access the site and copy files containing California student information. In plain terms, someone with a valid but stolen login was able to reach the site repeatedly over nearly four months before the activity was noticed.
The notice states that information about California students, including but not limited to all students enrolled in the three previous school years, was accessed and copied. That scope is very broad. The sources reviewed do not give a total number of people affected, and no count has been published by ETS or CDE.
ETS says it worked with law enforcement and cybersecurity experts to reduce the risk of the data becoming publicly accessible. It also says that, based on regular web monitoring, it has not found evidence that the information has been made public so far. Those are statements about what ETS has found to date, and they can change.
After the incident, ETS built an entirely new SFTP site with enhanced security controls. State agencies are also involved. According to the notice, the California Cybersecurity Integration Center is assisting with digital forensics, and CDE and the State Board of Education are reviewing the incident and ETS’s compliance with applicable data security and contractual requirements.
ETS is offering Experian IdentityWorks identity-protection services for 2 years at no cost, with one package for minors and another for adults who were students. Enrollment closes on March 19, 2027. A parent or legal guardian enrolls a minor, and adults can sign up directly using the instructions attached to the notice.
Student records are an attractive target because they link a child’s identity to a school, a home address and a long-lived identifier. Records that identify minors can be misused years later, since children often have no credit history to monitor. This is general context about education data and is not a statement about how this particular data will be used.
Notices were sent to students and families whose information was accessed and copied. If you believe you were affected but did not receive a letter, the notice and CDE’s incident page direct you to the assistance line listed there. Keep any letter you do receive, because it contains the activation information you need to enroll.
Because the files came from a shared exchange point between a testing contractor and a state agency, the incident touches a very large population: current students, former students who are now adults, and their families. The notice specifically says it covers affected current and former students, and that adults who were students in the covered years can enroll in protection services on their own behalf. Families who did not receive a letter but want to confirm whether a child was included can use the resources CDE has published.
Notices tend to arrive in stages and details can change as the investigation and the state’s review continue. Treat the letter you receive as the authoritative statement of what applies to you, and check CDE’s incident page for updates.
Notice also what the filing does not say. It does not give a number of affected people, and it does not say who the unauthorized party was or whether any group has claimed responsibility. This page will reflect only what the public notices state.
When Did This Breach Occur?
ETS says an unauthorized party used a compromised login credential at various times between May 22, 2026 and September 18, 2026 to copy files from the SFTP site.
ETS identified the unauthorized activity on September 25, 2026. The notice to California students and families was posted on October 16, 2026.
What Information Was Breached?
The notice says the information varies by individual and may include student names, dates of birth, residential addresses, schools, districts and grade levels. It may also include the Statewide Student Identifier and local student identifier.
Other categories that may be involved are gender, race or ethnicity, primary language, country of origin and English learner status, disability and Section 504 status, testing accommodations, and eligibility for programs such as Title I and McKinney-Vento. English language proficiency information and statewide assessment registration, participation and results may also be included.
ETS states the data did not include Social Security numbers, driver’s license numbers, passport numbers, financial account information, credit or debit card information, or account passwords, and that the incident did not involve parent or guardian personal information.
What You Can Do
If you received a notice related to Educational Testing Service or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the free Experian IdentityWorks services offered in the notice before the March 19, 2027 deadline. A parent or guardian can enroll a minor.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Educational Testing Service
If a student’s personal information was exposed in this incident, the family may have legal options. Organizations that hold the records of schoolchildren are expected to protect them, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
