19 OCT 2026 — Educational Testing Service (ETS), the contractor that administers California's state school tests, says an intruder used a compromised login to copy student records from a file-transfer server at intervals over almost four months. In a breach notice filed with the California Attorney General on 16 October, ETS says it is writing to students and families because the California Department of Education (CDE) told it to. It says the copied files cover, at a minimum, every student enrolled in the past three school years.
The notice gives no count of people affected and names no suspect. ETS says it has so far found no sign the data has been published.
A compromised credential and an SFTP server
According to the notice of data breach, ETS spotted unauthorised activity on 25 September 2026 on a secure file transfer protocol (SFTP) site it uses to swap statewide assessment information with the CDE. It disabled the account involved, took the site offline and brought in outside cybersecurity specialists.
Their investigation found that "an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026" to get in and copy files. The last known access came seven days before ETS identified the activity. The notice does not say how the credential was obtained, or whether the account had multi-factor authentication.
ETS says it has since built a replacement SFTP site with stronger security controls. Law enforcement agencies have been notified, and the notice states that their work did not hold it up.
What the files held
The data comes from what ETS keeps to run California's statewide assessments, including the CAASPP tests and the ELPAC English proficiency exams. What was copied varies from student to student. The notice lists name, date of birth, home address, school, district and grade, the Statewide Student Identifier and any local student number, along with gender, ethnicity, home language, country of origin and whether the student is classed as an English learner.
Beyond the contact details, disability records are on the list too, including Section 504 status, the type of disability and any testing accommodations. The list also includes eligibility for federal programmes such as Title I and McKinney-Vento, the scheme for homeless pupils, plus test registrations, participation and results.
ETS says the files did not contain Social Security numbers, driver's licence or passport numbers, financial account or card details, or passwords. No parent or guardian information was involved, according to the notice.
Former students are in scope
The wording "all students enrolled in the three previous school years" takes in pupils who have since left school, and the notice refers to affected "current and former students". It offers two Experian packages, one for minors enrolled by a parent or guardian and one for students, current or former, who are now 18 or older.
Watch the deadlines. Minors must be signed up by 19 March 2027. The main text gives the same date for adults, but the adult sign-up instructions say 19 March 2029. Minors who turn 18 before March 2029 can switch to the adult code on their birthday. Families who want the cover should treat 19 March 2027 as the safe date until the CDE clarifies the mismatch.
How the state responded
On 2 October, Deputy Superintendent Mary Nicely wrote to county and district superintendents that ETS had reported an incident involving its systems. ETS had "halted normal enrollment data processing and paused certain testing activities" while its security was assessed, the letter said. It gave no figures and said more would follow once facts were confirmed.
The October notice says the CDE and the State Board of Education are working with state cybersecurity experts. The California Cybersecurity Integration Center is handling digital forensics and incident response support, with the Department of Technology and the Governor's Office of Emergency Services also involved. The two education bodies are reviewing the incident and whether ETS met its "applicable data security and contractual requirements". No finding from that review has been published, and nothing in the notice says ETS breached its contract.
Scams are the nearer risk
Because the files held no Social Security numbers, the nearer danger is convincing fraud rather than new credit accounts opened in a child's name. A message quoting a child's school, grade, test history and student ID is far easier to believe than a cold approach. The notice itself warns families to be wary of unexpected emails, texts or calls that mention a student's school, state tests or the breach, and to "be cautious of fake identity protection sites by double checking URLs before providing information."
That warning matters. Enrolment in the free service runs through a web form and an activation code, and a fake enrolment page would be an obvious lure. The CDE has set up a page at cde.ca.gov/ets for updates and translated copies, and the notice gives a call-centre number for questions. The Attorney General's office keeps identity-theft guidance on its privacy pages.
What is still unknown
The Attorney General's breach register lists the filing under "CDE", gives 22 May 2026 as the breach date and records it as reported on 16 October. Neither the entry nor the notice states how many students are affected, who the intruder was, or whether any ransom was demanded. ETS says it has worked with law enforcement and its advisers to reduce the risk of the data being made public, and that its web monitoring has found no evidence of publication "to date". Until the state releases a number, the scale of the incident rests on the three-year enrolment window, and on the notice's own words that the window is a floor.
View author profile → · Editorial policy
