Educational Testing Service Data Breach

For about four months, an intruder copied California student files from a testing contractor’s system. The files can include disability status, Section 504 plans and program eligibility data about children.

Educational Testing Service (ETS), a nonprofit based in Princeton, New Jersey, runs California’s statewide student tests, including CAASPP and ELPAC, for the California Department of Education (CDE). On September 25, 2026, ETS identified unauthorized activity on a secure file transfer protocol (SFTP) site, a server used to send large data files. ETS used it to exchange test data with CDE.

According to the CDE incident page, an unauthorized party used a compromised login credential to access the site. That party copied files at various times between May 22 and September 18, 2026. ETS disabled the account and took the site offline. CDE reports that notification letters began going out on October 16, 2026, and should continue into early November.

Why the Four-Month Window Matters

The first known access happened on May 22, 2026. ETS did not identify the activity until September 25, 2026. That is 126 days, about 18 weeks, of access through one compromised login. The notice does not say how the credential was compromised or who used it.

ETS states that its web monitoring has found no evidence so far that the data has been made public. Still, the files were copied, and copied data can surface later.

Why Disability and Program Data About Children Is Sensitive

This breach did not involve Social Security numbers or bank information, but the data still matters. Some records include a child’s disability status, primary disability type, Section 504 status and testing accommodations. Others flag eligibility for McKinney-Vento (a federal program for students experiencing homelessness), Title I Part C (migrant education) or Military Connected Student programs. These details can reveal private facts about a family.

Who Is Affected?

CDE describes the affected group as current and former students enrolled in California public schools between 2023 and the current school year. The group also includes students who left a California school since 2006 without a confirmed transfer to another school. The ETS notice itself refers to all students enrolled in the three previous school years. CDE has not explained the difference.

ETS and CDE have not released a total count of people affected. Former students who are now adults may also be affected.

What Information Was Exposed?

According to the CDE incident page, the information varies by student and may include:

• Names, dates of birth and home addresses
• Schools, districts and grade levels
• Statewide Student Identifier (SSID) and local student ID
• Gender, race or ethnicity, primary language and country of origin
• English learner status and English language proficiency
• Disability and Section 504 status, testing accommodations and primary disability type
• Eligibility for Title I Part A, Title I Part C, McKinney-Vento and Military Connected Student programs
• Statewide test registration, participation and results

CDE states that the incident did not involve Social Security numbers, driver’s license or passport numbers, financial account or card information, passwords, or parent and guardian information.

What Is ETS Offering Affected Students?

ETS is offering 24 months of Experian IdentityWorks at no cost. Parents and guardians of students under 18 can enroll a child in Minor Plus at experianidworks.com/minorplus. Former students 18 and older can enroll at experianidworks.com/identity. The enrollment deadline is March 19, 2027. The call center is 833-931-8488 (weekdays, 6 a.m. to 6 p.m. Pacific).

Your Child’s Information Is at Risk

Children rarely use credit, so fraud on a child’s record can go unnoticed for years. Scammers may also use details from the files to make fake messages look official.

Affected families and former students should:

• Enroll in the free Experian service before March 19, 2027
• Consider a free credit freeze for children under 16 and for adult former students
• Pull free credit reports at annualcreditreport.com
• Treat unexpected emails, texts or calls about ETS with caution, and use the official page at cde.ca.gov/ets

Do You Have Legal Options?

Testing vendors that collect student data have a legal obligation to safeguard it. When that obligation is not met, affected students and families may have legal rights and remedies.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. No Fee Unless We Recover.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

FAQ

How many people were affected by the ETS data breach?

ETS and CDE have not released a total. The affected group covers students enrolled from 2023 to now, plus some former students who left a California school as far back as 2006.

What information was exposed?

It varies by student. Key items include:

• Name, birth date and address
• Student ID numbers
• Disability and Section 504 details
• Program eligibility and test results

How long did the intruder have access?

According to CDE, files were copied at various times from May 22 to September 18, 2026. ETS found the activity on September 25.

I didn’t get a letter. Could my child still be affected?

Yes. CDE says not receiving a letter does not necessarily mean your child’s information was unaffected. Letters are expected to continue into early November.

Why is a child’s data a target for identity theft?

A child’s credit record is usually blank and unwatched. A criminal can pair a real name, birth date and address with made-up details to build a new identity. The fraud may not show up until your child applies for a first loan or apartment.

Can I freeze my child’s credit?

Yes. Parents and guardians can request a free credit freeze for children under 16 at each of the three credit bureaus. A freeze blocks new credit in your child’s name until you lift it. Adults can freeze their own credit for free.

Has a lawsuit been filed against ETS?

Yes. At least one class action over this incident has been filed against ETS in federal court in California (October 17, 2026), and a second federal case filed in New Jersey may be related. Filing a lawsuit does not mean anyone has proven claims or that any outcome is certain. If you or your child received a notice, you may have rights of your own. A Free Case Review can help you understand your options.

What should I do if I received a notification letter?

• Enroll in Experian IdentityWorks by March 19, 2027
• Consider a credit freeze
• Keep your letter and activation code
• Request a Free Case Review

Do I have a legal claim?

Organizations that collect student records have a duty to protect them and to tell families promptly when that protection fails. If you or your child received a notice, you may have rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.