What was in the California student files ETS says were copied

Educational Testing Service says an unauthorized party used a compromised login to copy California student files from a file-transfer site. The copying ran, at various times, from May 22 to September 18, 2026. ETS found the activity on September 25. The California Department of Education started sending ETS’s notice to students and families on October 16.

The department has not published a count of people. The notice covers a wide set of students, and it is specific about what was in the files and what was not. Social Security numbers, financial accounts, passwords, and parent or guardian information were not in the copied data.

If you and your children were never enrolled in a California public school, this is not your file. Families who moved away, including to Canada, can still be in it. The department’s definition reaches students who left a California school since 2006 and did not confirm a transfer.

What ETS was holding

ETS is the contractor for California’s statewide tests, including the California Assessment of Student Performance and Progress and the English Language Proficiency Assessments for California. The site was the SFTP server ETS used to exchange that assessment information with the department.

The notice says the copied files include students enrolled in the three previous school years, and are not limited to them. What any one student has in the copy varies. It may include:

• name, date of birth, home address, school, district, and grade
• the Statewide Student Identifier, a random 10-digit number California assigns to a public-school student, and a local student identifier
• gender, race or ethnicity, primary language, country of origin, and English-learner status
• disability and Section 504 status, testing accommodations, and primary disability type
• eligibility for Title I Part A, Title I Part C, McKinney-Vento, and the Military Connected Student program
• English-language proficiency, and statewide test registration, participation, and results

The department’s FAQ says not every student’s record contained all of that. It also says the copied data did not include Social Security numbers, driver’s licence numbers, passport numbers, payment cards, or account passwords, and did not include a parent or guardian’s own information.

ETS says that after working with law enforcement and outside experts it has taken steps to reduce the chance the files are posted publicly, and that its own web monitoring had not found them public at the time of the notice. That is a statement about what ETS had found, not a promise the files cannot surface later.

Who is being notified

Notification began October 16 and the department said it expected mailing to continue through early November. A letter or email means that student’s information was in the copied files.

Not getting a letter does not mean you were left out. The FAQ says some current and former students may not be reached, particularly if their contact information changed. It defines affected people as current and former students enrolled in a California public school between 2023 and the current school year, and students who left a California school since 2006 and did not confirm a transfer with the department.

The state is not treating this as a lost password. The California Cybersecurity Integration Center is helping with forensics. The department and the State Board of Education are also reviewing whether ETS met its contract. The SFTP site was taken offline. ETS says it is building a new one.

What families were told to do

ETS is offering two years of Experian IdentityWorks at no cost. The enrollment deadline on the notice is March 19, 2027. There is a minor product and an adult product. A student who turns 18 before March 19, 2029 can move to the adult product on their birthday, using the code in the notice. The FAQ says identity-restoration help is available for 24 months from the notice even if you do not enroll in monitoring, for eligible people who actually suffer identity theft. No credit card is required to enroll.

The notice’s own warning matters more than the product name. Be wary of a site that looks like identity protection and asks you to type the student’s information. Enrollment instructions are in the letter and on the department’s incident page. The phone number printed on the notice is 833-931-8488, weekdays 6 a.m. to 6 p.m. Pacific, and the notice asks for an engagement number: B174774 for a student under 18, B174775 for a student 18 or over. A call or text that asks for a Social Security number, a password, or a card is not this process. Those items were not in the files, and the notice says not to give them to an unsolicited message.

Adults can put a free security freeze on their own credit file. The FAQ also says parents may request a free credit freeze for a child under 16. A freeze is a reasonable step. It does not pull the copied school records back.

For a family in Canada, the practical question is whether a child was in a California public school in that window. If yes, use the department’s page rather than a link in an unexpected email. If no, there is nothing to enroll in, and nothing in this incident to “verify” by handing someone a birth date.

Sources

• California Department of Education, Educational Testing Service (ETS) Notification
• California Department of Education, ETS Data Security Incident, release 45, 2026
• California Department of Education, ETS incident questions