{"id":"ets-california-student-records-oct-2026","category":"breach","status":"closed","title":"ETS breach exposes California pupils’ records, including disability information","tldr":"An intruder copied California pupils’ records from ETS, including disability information for some. Current and former pupils are affected. Use CDE’s official notice to enrol in two years of free identity protection by 19 March 2027.","summary":"An intruder used compromised login details to copy California public-school pupil records from Educational Testing Service (ETS), the state’s assessment contractor, between 22 May and 18 September 2026. The records cover all pupils enrolled during the previous three school years and some who left school as far back as 2006 without a confirmed transfer. Information varies by pupil and includes names, birth dates, addresses, student identifiers and assessment results; some records include disability types and testing accommodations. ETS says Social Security numbers, passwords, financial details and parents’ information were excluded. No confirmed affected-person count was published in the sources reviewed. ETS disabled the account and took the site offline. CBS reported that a replacement had been built; ETS’s own notice describes building one without confirming operational status. As of 3 November, the reviewed disclosures do not confirm notification completion or deletion of the stolen copies. ETS reported no evidence of public release, and free identity protection remains available.","action":"If you or your child attended a California public school from 2023 onwards, or left since 2006 without a confirmed transfer, check CDE’s official ETS notice even if no letter arrives. Follow its instructions to enrol in free Experian IdentityWorks protection by 19 March 2027; no credit card is required. Treat unexpected school-related messages cautiously and verify them through the school or CDE before sharing personal information.","product":"Educational Testing Service (ETS) California public-school assessment records","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["ets","california","education","data-breach","children","identity-theft"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Educational Testing Service (ETS) Notification — Notice of Data Breach","url":"https://www.cde.ca.gov/nr/in/ets-notification.asp","by":"ETS, published by California Department of Education","date":"2026-10-16"},{"kind":"advisory","title":"Frequently Asked Questions for California Students and Families","url":"https://www.cde.ca.gov/nr/in/documents/etsbreachfaq-english.pdf","by":"California Department of Education","date":"2026-10-16"},{"kind":"advisory","title":"ETS Begins Notifying California Students and Families Following Data Security Incident","url":"https://www.cde.ca.gov/nr/ne/yr26/yr26rel45.asp","by":"California Department of Education","date":"2026-10-16"},{"kind":"news","title":"One Compromised Login Exposed Millions of California Students’ Records","url":"https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/","by":"SecurityWeek","date":"2026-10-19"},{"kind":"news","title":"California state testing data breach may impact millions of students, officials say","url":"https://www.cbsnews.com/sanfrancisco/news/california-state-testing-ets-data-breach-impact-millions-of-students-officials-say/","by":"CBS San Francisco","date":"2026-10-20"},{"kind":"news","title":"ETS breach exposes California student testing records","url":"https://www.cyberbreaches.org/en/incidents/educational-testing-service-2026-10-22","by":"Cyber Breaches","date":"2026-10-22"}],"started":"2026-10-02","closed":"2026-10-16","created":"2026-11-03T20:25:33.163Z","updated":"2026-11-03T20:25:33.163Z","cve_notes":[],"timeline":[{"at":"2026-10-16","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Notifications to students and families began, with distribution expected to continue into early November. ETS offered two years of free Experian IdentityWorks protection and reported finding no evidence that the copied information had been made public.","url":"https://www.cde.ca.gov/nr/ne/yr26/yr26rel45.asp","by":"California Department of Education","patch":null},{"at":"2026-10-02","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"CDE informed county and district superintendents and charter-school administrators by letter. ETS had paused routine enrolment-data processing and some testing work during security checks.","url":"https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/","by":"SecurityWeek","patch":null},{"at":"2026-09-25","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"ETS detected unauthorised activity. It disabled the account, took the affected site offline and brought in external cybersecurity investigators.","url":"https://www.cde.ca.gov/nr/in/ets-notification.asp","by":"ETS, published by California Department of Education","patch":null},{"at":"2026-09-18","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"This was the last date of unauthorised access identified by the investigation.","url":"https://www.cde.ca.gov/nr/in/ets-notification.asp","by":"ETS, published by California Department of Education","patch":null},{"at":"2026-05-22","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"The earliest confirmed unauthorised access began. An intruder used compromised login details to copy California pupil records from ETS’s file-transfer site.","url":"https://www.cde.ca.gov/nr/in/ets-notification.asp","by":"ETS, published by California Department of Education","patch":"na"}],"url":"https://hard.fyi/live/ets-california-student-records-oct-2026/","json":"https://hard.fyi/api/live?id=ets-california-student-records-oct-2026"}