ETS breach exposes California pupils’ records, including disability information
An intruder copied California pupils’ records from ETS, including disability information for some. Current and former pupils are affected. Use CDE’s official notice to enrol in two years of free identity protection by 19 March 2027.
If you or your child attended a California public school from 2023 onwards, or left since 2006 without a confirmed transfer, check CDE’s official ETS notice even if no letter arrives. Follow its instructions to enrol in free Experian IdentityWorks protection by 19 March 2027; no credit card is required. Treat unexpected school-related messages cautiously and verify them through the school or CDE before sharing personal information.
What’s happening
An intruder used compromised login details to copy California public-school pupil records from Educational Testing Service (ETS), the state’s assessment contractor, between 22 May and 18 September 2026. The records cover all pupils enrolled during the previous three school years and some who left school as far back as 2006 without a confirmed transfer. Information varies by pupil and includes names, birth dates, addresses, student identifiers and assessment results; some records include disability types and testing accommodations. ETS says Social Security numbers, passwords, financial details and parents’ information were excluded. No confirmed affected-person count was published in the sources reviewed. ETS disabled the account and took the site offline. CBS reported that a replacement had been built; ETS’s own notice describes building one without confirming operational status. As of 3 November, the reviewed disclosures do not confirm notification completion or deletion of the stolen copies. ETS reported no evidence of public release, and free identity protection remains available.
- What
- Breach
- Affects
- Educational Testing Service (ETS) California public-school assessment records
- Fixed in
- Nothing to patch
- Since
- 2 Oct 2026
- Closed
- 16 Oct 2026
Timeline
- Update
Notifications to students and families began, with distribution expected to continue into early November. ETS offered two years of free Experian IdentityWorks protection and reported finding no evidence that the copied information had been made public.
- Made public
CDE informed county and district superintendents and charter-school administrators by letter. ETS had paused routine enrolment-data processing and some testing work during security checks.
- Update
ETS detected unauthorised activity. It disabled the account, took the affected site offline and brought in external cybersecurity investigators.
- Update
This was the last date of unauthorised access identified by the investigation.
- UpdateNothing to patch
The earliest confirmed unauthorised access began. An intruder used compromised login details to copy California pupil records from ETS’s file-transfer site.
Sources
- Educational Testing Service (ETS) Notification — Notice of Data BreachETS, published by California Department of Education · 16 Oct 2026
- Frequently Asked Questions for California Students and FamiliesCalifornia Department of Education · 16 Oct 2026
- ETS Begins Notifying California Students and Families Following Data Security IncidentCalifornia Department of Education · 16 Oct 2026
- One Compromised Login Exposed Millions of California Students’ RecordsSecurityWeek · 19 Oct 2026
- California state testing data breach may impact millions of students, officials sayCBS San Francisco · 20 Oct 2026
- ETS breach exposes California student testing recordsCyber Breaches · 22 Oct 2026