TL;DR: The ETS data breach exposed records of millions of current and former California public school students. Someone used a stolen login to copy files from an Educational Testing Service (ETS) file-transfer site between May 22 and September 18, 2026. The copied data can include names, birth dates, home addresses, school and grade, statewide student IDs, disability and Section 504 status, and state test results. It did not include Social Security numbers, financial details, passwords or parent information. Notices started going out on October 16 and will continue through early November. Families can get two years of free Experian IdentityWorks (enroll by March 19, 2027). Parents of children under 16 should also consider a free credit freeze. Expect convincing scam emails and texts that mention your child’s school.
Last updated: October 20, 2026. By Veer. Facts checked against the California Department of Education’s ETS incident page and FAQ, the ETS Notice of Data Breach (last reviewed October 19), CDE’s October 16 news release, reporting by the Los Angeles Times, SecurityWeek and LAist, the FTC’s child identity theft guide and the federal court docket on CourtListener. This is a researched explainer. We haven’t enrolled in any of the services described below.
What happened in the ETS data breach?
The ETS data breach is a theft of California student records from a secure file transfer protocol (SFTP) site that Educational Testing Service ran to swap statewide test data with the California Department of Education (CDE). According to CDE’s notice, an unauthorized party “used a compromised login credential” to copy files at various times from May 22 to September 18, 2026.
ETS spotted the unauthorized activity on September 25, 2026. That’s a week after the last known download. It disabled the account, took the SFTP site offline and brought in outside cybersecurity experts. ETS says it has since built “an entirely new SFTP site with enhanced security controls.”
ETS is the nonprofit that runs California’s state-mandated tests, including the CAASPP (Smarter Balanced) and the ELPAC English proficiency test. Because it handles that testing for every public school in the state, a single stolen password was enough to expose records statewide rather than one district’s.
How long did it take for families to hear about it?
About three weeks. CDE told county and district superintendents in a letter dated October 2, SecurityWeek reports. The public announcement and the first family notices followed on October 16. CDE’s news release says notifications will keep going out “through early November,” by letter and email.
Who is affected by the ETS breach?
CDE says the copied files cover “all students enrolled in the three previous school years,” and that the affected group isn’t limited to them. Its FAQ spells out two groups:
- Current and former students enrolled in a California public school from 2023 through the current school year.
- Students who left a California school as far back as 2006 and whose transfer to another school was never confirmed with CDE.
CDE hasn’t published a total. For scale, more than 5.7 million students were enrolled in California public schools in the 2025–26 school year alone, according to CDE figures cited by SecurityWeek. The Los Angeles Times says the breach “affects many more than” that 5.7 million because it reaches back to 2023 enrollments and, for unconfirmed transfers, to 2006.
That means adults can be affected too: anyone who was in a California public school recently, plus some people who moved out of state years ago. Many of them won’t have a current address on file.
What if I didn’t get a letter?
Not getting a letter doesn’t mean you’re safe. CDE says so directly: “Not receiving a notification does not necessarily mean your and/or your student’s information was unaffected,” especially if your contact details have changed. If you or your child fits one of the two groups above, treat yourself as affected and follow the steps below. A letter or email does confirm that your record was in the copied files.
Are GRE, TOEFL or SAT test-takers affected?
Nothing so far says they are. ETS also runs the GRE, TOEFL and Praxis tests, but an ETS spokesperson told the Los Angeles Times that no other “ETS customers” were affected. The SAT is run by the College Board, not ETS. The incident covers California’s statewide K–12 assessment data only.
What data was exposed in the ETS data breach?
What was copied varies from student to student. CDE notes that “not every student’s record contained all these types of information.” This table is built from CDE’s notice and FAQ.
| Exposed (may include) | Not exposed (per CDE) |
|---|---|
| Name, date of birth, home address | Social Security numbers |
| School, district and grade level | Driver’s license and passport numbers |
| Statewide Student Identifier (SSID) and local student ID | Bank account, credit and debit card details |
| Gender, race or ethnicity, primary language, country of origin | Account passwords |
| English learner status and English proficiency results | Any parent or guardian information |
| Disability and Section 504 status, testing accommodations, primary disability type | |
| Eligibility for Title I, Part A and Part C (migrant education), McKinney-Vento (homeless students) and Military Connected Student programs | |
| State test registration, participation and results |
An SSID is a “unique, randomly generated 10-digit number” assigned to each student in California’s public K–12 system, according to CDE. It’s an education record number, not a financial ID.
Has the stolen data been leaked online?
Not as far as anyone has said. ETS says its “regular web monitoring” has “not uncovered any evidence that the information has been made public.” It also says it has “taken steps to reduce the potential risk of the data being made publicly accessible.” ETS didn’t explain what those steps were. The Los Angeles Times notes that hackers often hold data back while they press for a ransom, and the official statements don’t say whether anyone has demanded one. None of the official statements or news reports cited here name the attacker or mention a claim of responsibility.
Why does this breach matter if no Social Security numbers were taken?
The ETS records are risky even without Social Security numbers, for three reasons.
- They make very convincing scams. A message that gives your child’s real name, school, grade and test scores is far easier to believe than a generic phishing email. CDE warns families to be careful with “unexpected emails, text messages, or phone calls that reference a student’s school, statewide assessments, or this incident.”
- They’re part of an identity. A name, date of birth and home address are three of the pieces criminals use to open accounts. They can combine them with a Social Security number stolen in some other breach. Children make attractive targets because nobody checks a child’s credit for years. The FTC lists things like a student loan denied over “bad credit” as a warning sign.
- Some of it is permanent and very personal. Disability type, Section 504 status, homeless-student status and immigration-related details like country of origin can’t be changed or “frozen” the way a credit card can. “When millions of student records are concentrated with a single vendor, one security failure can become a statewide problem with consequences that follow children for years,” Anton Dahbura of the Johns Hopkins University Information Security Institute told the Los Angeles Times.
What should California families do now?
Start with the free credit monitoring and a credit freeze, then get ready for scam messages. Most of the steps below cost nothing and take under an hour. Who needs what depends on age:
| Who | Free monitoring (ETS/Experian) | Credit freeze | Also do |
|---|---|---|---|
| Child under 16 | Parent enrolls in IdentityWorks Minor Plus by March 19, 2027 | Parent requests a free freeze at Equifax, Experian and TransUnion | Ask the bureaus to check whether a credit file exists in the child’s name |
| Teen aged 16–17 | Parent enrolls in Minor Plus; can switch to the adult product at 18 | Teen can request and lift a freeze themselves (per the FTC), or a parent can help | Watch for messages that use school details |
| Former student, 18+ | Enroll in IdentityWorks (adult) by March 19, 2027 | Freeze your own credit at all three bureaus | Pull free reports at annualcreditreport.com |
1. Enroll in the free Experian IdentityWorks service
ETS is paying for 24 months of Experian IdentityWorks for every affected current and former student. Enrollment is free and “no credit card information will be requested,” the notice says. There are two versions:
- Minors (under 18): a parent or guardian enrolls at experianidworks.com/minorplus. The notice says the minor product checks whether a credit file exists for the child and alerts you to names and addresses linked to the child’s Social Security number. It also includes dark-web scanning, identity restoration and $1 million of identity theft insurance.
- Adults (18+): enroll yourself at experianidworks.com/identity. It offers dark-web scanning, identity restoration and the same insurance.
The activation codes are printed in your letter and in the online notice. If you call the helpline, have the engagement number ready: B174774 for students under 18 or B174775 for students 18 or older.
Mind the deadline. CDE’s FAQ gives March 19, 2027 as the deadline for both products. The adult enrollment steps in the notice say “March 19, 2029” in one place, and the same section gives March 19, 2027 for the phone line. To be safe, treat March 19, 2027 as the real deadline. Teens who turn 18 before March 19, 2029 can move to the adult product with the adult code.
Identity restoration help from Experian lasts 24 months from the date of the letter, and you don’t have to enroll in monitoring to use it.
2. Freeze your child’s credit (and your own, if you’re a former student)
A credit freeze is the strongest free protection, and it beats monitoring. Monitoring tells you after someone opens an account. A freeze stops most new accounts from being opened in the first place. Under federal law, freezes are free. You can get one for a child under 16, and requests made online or by phone must be placed within one business day, according to the notice.
- Contact Equifax (800-685-1111), Experian (888-397-3742) and TransUnion (833-799-5355). A freeze only applies at the bureau where you place it, so you need all three.
- For a minor, use each bureau’s child freeze process. It’s different from the adult one. The FTC says you may need your ID, proof of address, and the child’s birth certificate and Social Security card.
- Ask each bureau for a manual search for a credit file under your child’s Social Security number. A child under 18 generally shouldn’t have one, so an existing file is a red flag.
- Keep the PINs or account logins the bureaus give you. You’ll need them to lift the freeze when your child applies for a student loan or a first credit card.
Adults can also pull free credit reports at annualcreditreport.com (1-877-322-8228).
3. Treat every “ETS,” “CDE” or “Experian” message as suspect
Scammers watch breach headlines and copy the details. It’s the same playbook as the fake “refund” and “account verification” messages we warned about after the Stop & Shop cyberattack, except this time the scammer may know your child’s school and grade. CDE’s rules of thumb:
- Don’t give out Social Security numbers, passwords or payment details in response to any message about this incident. Legitimate enrollment never needs a card.
- Type the enrollment addresses yourself (experianidworks.com/minorplus or /identity) instead of tapping links. CDE specifically warns about “fake identity protection sites.”
- If you’re unsure, check cde.ca.gov/ets or call 833-931-8488 (Monday to Friday, 6 a.m. to 6 p.m. Pacific).
- Forward scam texts to 7726 (SPAM) so your carrier can block the sender.
4. Lock down the accounts and devices your kids use
The ETS files didn’t include passwords, but phishing aimed at students is how the next account takeover usually starts. Turn on two-step sign-in for school and personal email. An authenticator app or passkey is safer than text codes; our guide to whether SMS 2FA is safe explains why.
Keep kids’ phones updated too. Hand-me-down iPhones that can’t run iOS 27 still get security fixes, such as the iOS 26.7.1 security update.
5. Know the warning signs of child identity theft
According to the FTC, signs include collection calls about a bill you never opened, an IRS letter about your child’s “income,” being denied government benefits because the child’s number is already in use, or a student loan denied over bad credit. If any of these happen, report it at IdentityTheft.gov, ask the companies to close the accounts in writing, and freeze the child’s credit.
Is there an ETS data breach lawsuit?
Yes. A proposed class action, PL01 v. Educational Testing Service, No. 2:26-cv-12163, was filed on October 17, 2026 in the U.S. District Court for the Central District of California, according to the federal docket. The plaintiff, a former California public school student, filed under a pseudonym. The claims are allegations only. No class has been certified, there’s no settlement, and there’s nothing to file or claim. Be wary of any site asking for your child’s details “to join the settlement.”
What are ETS and the state doing about it?
The state is investigating with outside help, and ETS has replaced the hacked system. CDE says the California Cybersecurity Integration Center (Cal-CSIC) is handling digital forensics and incident response, with support from the California Department of Technology and Cal OES. CDE and the State Board of Education are also “reviewing the incident and ETS’s compliance with applicable data security and contractual requirements.”
ETS has defended its security. “ETS maintains a comprehensive information security program that is regularly assessed by third parties,” spokesperson Christine Betaneli told the Los Angeles Times. She added that ETS has added “enhanced monitoring, strengthened access controls and further third-party review.” Neither ETS nor CDE has said how the login was stolen or whether it was protected by multi-factor authentication.
This is the second big California education breach this year. In May 2026, hackers breached Instructure, the company behind Canvas, which forced it to take the learning platform offline temporarily (Los Angeles Times). Like the ConnectWise breach this month, the ETS case started with one compromised credential at a trusted vendor, not a break-in at the schools themselves.
ETS data breach timeline
| Date (2026) | Event |
|---|---|
| May 22 | Earliest known access to the ETS SFTP site using a compromised login |
| September 18 | Last known access and file copying |
| September 25 | ETS identifies the unauthorized activity, disables the account and takes the site offline |
| October 2 | CDE notifies county and district superintendents and charter schools (SecurityWeek) |
| October 16 | CDE announces the incident; ETS starts mailing and emailing notices |
| October 17 | Proposed class action filed in federal court in Los Angeles |
| Early November | Notifications expected to finish |
| March 19, 2027 | Deadline to enroll in the free Experian IdentityWorks service |
FAQ
What is the ETS data breach?
The ETS data breach is the theft of California public school student records from an Educational Testing Service file-transfer site. An attacker used a compromised login to copy files between May 22 and September 18, 2026. ETS found the activity on September 25, and families started getting notices on October 16, 2026.
Who is affected by the ETS data breach?
Current and former students enrolled in California public schools from 2023 through the current school year are affected, plus students who left a California school since 2006 without a confirmed transfer. CDE hasn’t released a total, but 2025–26 enrollment alone was more than 5.7 million.
Were Social Security numbers stolen in the ETS breach?
No. CDE says the files didn’t include Social Security numbers, driver’s license or passport numbers, financial account or card details, or passwords. No parent or guardian information was involved either.
How do I sign up for the free ETS credit monitoring?
Parents enroll children under 18 at experianidworks.com/minorplus, and adults enroll at experianidworks.com/identity, using the activation code in the notice. It’s free for 24 months, needs no credit card, and the deadline is March 19, 2027. Questions go to 833-931-8488.
Should I freeze my child’s credit after the ETS breach?
Yes, it’s worth doing for children under 16. A credit freeze is free, it stops most new accounts from being opened in your child’s name, and it stays in place until you lift it. You have to request it separately at Equifax, Experian and TransUnion.
I didn’t get a letter. Am I safe?
Not necessarily. CDE says some affected students won’t get a notice, especially if their contact details have changed. If you or your child was in a California public school from 2023 onward, or left one after 2006 without a confirmed transfer, assume you’re affected and follow the same steps.
Sources
- California Department of Education: Educational Testing Service (ETS) Incident page and FAQ (last reviewed October 16, 2026)
- CDE: ETS Notice of Data Breach (web version) and PDF (last reviewed October 19, 2026; 27 languages)
- CDE news release: ETS Begins Notifying California Students and Families Following Data Security Incident (October 16, 2026)
- Los Angeles Times: Standardized testing hack exposes names and addresses of millions of students (October 16, 2026)
- SecurityWeek: One Compromised Login Exposed Millions of California Students’ Records (October 19, 2026)
- LAist: Student data breach: what to do (October 19, 2026)
- Orange County Department of Education: Statewide student data breach: What California families should know (October 19, 2026)
- CourtListener: PL01 v. Educational Testing Service, 2:26-cv-12163 (C.D. Cal.) (filed October 17, 2026)
- FTC: How To Protect Your Child From Identity Theft
