Hackers Copy Data on Millions of California Students From Testing Firm ETS

The California Department of Education said on Friday, October 16, that hackers copied personal information on millions of current and former public school students. The data came from a file transfer site run by Educational Testing Service (ETS), the nonprofit that gives the state's required tests, including the CAASPP and ELPAC. According to the department's notice, ETS spotted unauthorized activity on September 25. Its investigation found that someone used a stolen login to copy files with student information at various times between May 22 and September 18, 2026.

The state says the breach includes, but is not limited to, every student enrolled in the three previous school years, CBS News reported. California counted more than 5.7 million public school students in 2025-26. The Los Angeles Times reported that students who left California without a confirmed transfer are also affected, with records going back to 2006. Not every student had every detail exposed. SecurityWeek reported that records can include name, birth date, home address, school, grade, state student ID number, gender, race or ethnicity, primary language, English learner status and test results. For some students, the files also show disability and Section 504 status, testing accommodations, and whether a student qualifies as low-income, homeless under McKinney-Vento, or military-connected. The notice says Social Security numbers, driver's license numbers, passwords, financial account details and parent or guardian information were not involved. ETS says it has found no evidence so far that the data has been made public.

ETS shut down the account, took the site offline and is building a replacement with stronger safeguards. It is working with outside cybersecurity experts and law enforcement. The department says it is checking whether ETS met the security requirements in its state contract. An ETS spokesperson, Christine Betaneli, told the Los Angeles Times that the organization "maintains a comprehensive information security program that is regularly assessed by third parties." She also said no other ETS customers were affected.

Because no Social Security numbers were taken, it is harder for someone to open a credit card in a child's name using this data alone. The details that were taken are still useful to a scammer. A birth date and home address do not change, and a message that names a child's school, grade or test scores sounds official. That makes school-themed scams the most likely next risk for families.

Enroll first. Watch for an email or letter from ETS, which is offering 24 months of free Experian IdentityWorks protection. A parent or guardian signs up students under 18 for the minor product, adults sign themselves up, and the deadline is March 19, 2027. LAist notes that not getting a letter does not mean a student is safe. If your child attended a California public school, call the ETS helpline at 833-931-8488, 6 a.m. to 6 p.m. Monday through Friday. The department also advises double-checking web addresses, because fake identity protection sites often show up after breaches like this one.

Freeze your child's credit at each of the three credit bureaus. A freeze is free, and it stops new accounts from being opened in that name until you lift it. Our guide to protecting yourself against identity theft walks through freezes, monitoring and the paperwork to keep on file.

Treat any unexpected message about the breach, test scores or special education services as suspect until you confirm it with your school or district. Type the web address yourself instead of clicking a link. Brush up on the warning signs with our guide to spotting phishing, and teach older kids to show you any message that knows where they go to school.

Protect your own accounts the same way. This breach started with one stolen login. Turning on multi-factor authentication for your family's email, school portals and bank accounts means a stolen password alone will not get someone in.

ETS and the state are still investigating, and notices are going out to families now. Enroll, freeze and verify, and you will have covered the steps that matter most for your child's records. Be Prepared Not Scared!