Breach · · 4 min read
A stolen login let someone copy California student testing files for four months
ETS says an outsider used a compromised login on a state file-transfer site from May to September. Names, birth dates, addresses and disability status were copied.
On Friday, October 16, 2026, the California Department of Education (CDE) told families that student records had been stolen from Educational Testing Service (ETS), the nonprofit that runs the state’s standardized tests, including the Smarter Balanced exams (CAASPP) and the English proficiency tests (ELPAC). The official notice says someone used a compromised login to copy files from an ETS file-transfer site “at various times” between May 22 and September 18, 2026. ETS spotted the activity on September 25. If you, or your children, didn’t attend a California public school, you aren’t in this one. If you did, here’s what was taken and what’s worth doing.
What was copied
The notice says the stolen files cover, at least, every student enrolled in a California public school in the past three school years. The details vary by student, but may include:
- name, date of birth, home address, school, district and grade
- the statewide student ID and the local student ID
- gender, race or ethnicity, primary language, country of origin and English learner status
- disability and Section 504 status, testing accommodations and primary disability type
- eligibility for federal programs, including Title I, McKinney-Vento (for students experiencing homelessness) and the military-connected student program
- test registrations, participation and results
ETS says the files did not include Social Security numbers, driver’s licence or passport numbers, financial or card information, or passwords, and no parent or guardian information.
How many students
The notice doesn’t give a total. The Los Angeles Times reports it reaches well beyond the state’s 5.7 million current public-school students, because it goes back to 2023 enrollments, and back to 2006 for students who left California without a confirmed transfer to another school. Politico reported that the CDE put it at the 7 million students enrolled over the past three school years. District leaders were told on October 2, two weeks before the public notice, according to the Times.
ETS says it disabled the account, took the site offline and built a new one, and that its web monitoring hasn’t found the data published. The notice doesn’t say whether anyone has demanded a ransom, and the Times notes the release didn’t address it. The state’s cybersecurity center (Cal-CSIC) is helping with the investigation, and the CDE says it is reviewing whether ETS met its data-security obligations.
Why it matters
This is mostly data about children, and much of it can’t be changed. A child’s name, birth date and address can be used to open credit in their name, and that can go unnoticed for a long time, because few people check a child’s credit. Disability and program data is the kind of detail a scammer can use to sound like a school or a support agency. And it was all taken with one compromised login, on and off for four months, before anyone noticed.
If your family is affected
- Enroll in the free identity protection from the official page. ETS is offering two years of Experian IdentityWorks, with one plan for students under 18 and one for adults. The activation codes and the enrollment deadline (March 19, 2027) are in the CDE notice. Open it by typing the address, not from a link in an email or text. The notice itself warns about fake identity-protection sites.
- Freeze your child’s credit. In the U.S., a credit freeze is free, including for children under 16, and officials suggest parents consider one. You have to ask Equifax, Experian and TransUnion separately.
- Treat messages about the school, the tests or this breach with suspicion. That includes callers who say they’re from ETS, the state or a credit-monitoring company. Officials say not to give out Social Security numbers, passwords or financial details in response to unsolicited requests.
- Questions go to the ETS call centre at 833-931-8488, weekdays 6 a.m. to 6 p.m. Pacific. Use engagement number B174774 for students under 18 and B174775 for students 18 or older.
Sources
- California Department of Education, Educational Testing Service (ETS) Notification, October 16, 2026
- Los Angeles Times, Hackers steal personal data of millions of California students in massive breach, October 16, 2026
- Politico, Hack exposes data on millions of California students, October 16, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.