California warns all public school students that hackers copied their data from testing firm ETS

The California Department of Education has begun warning families that hackers copied student records from Educational Testing Service, the contractor that runs the state’s assessment data exchange. Notices started going out on Oct. 16, and the department says they will keep arriving through November. The affected group is broad: current and former students enrolled in California public schools from 2023 to the current school year, plus some who left a school as long ago as 2006.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

The exposed files hold more than names and birthdays. Depending on the student, they can include disability status, testing accommodations and eligibility for federal aid programs, which makes the information useful for targeted fraud and sensitive in its own right.

How ETS lost control of the file transfer site

According to the department’s incident page, an unauthorized party used a compromised login credential to reach an ETS-operated secure file transfer protocol site that exchanges statewide assessment information with the state. The party copied student files between May 22 and Sept. 18, 2026, a window of nearly four months. ETS identified the unauthorized activity on Sept. 25, disabled the account, took the site offline and built a replacement site with stronger security controls.

The Record’s coverage of the warning, by Jonathan Greig, adds that ETS said it worked with law enforcement and cybersecurity experts, halted normal enrollment data processing and paused certain testing activities. No hacking group had claimed responsibility as of the article’s publication on Oct. 20, and ETS did not respond to the outlet’s requests for comment.

What the copied student records contain

The state lists the categories on its incident page. Every affected student may have had names, dates of birth, residential addresses, schools, districts and grade levels copied, along with the statewide student identifier and a local identifier. Demographic fields include gender, race or ethnicity, primary language, country of origin and English learner status. The files may also show disability and Section 504 status, testing accommodations and primary disability type, eligibility for Title 1 Part A, Title 1 Part C, McKinney-Vento and Military Connected Student programs, and English language proficiency and statewide assessment registration, participation and results.

Not involved, the state says, are Social Security numbers, driver’s license or passport numbers, financial account or card information, and account passwords. The incident also did not involve any personal information about parents or guardians.

California has about 5.7 million students enrolled in public K-12 schools, according to The Record, though the article gives no total for how many records were copied. That gap is why the department’s notice casts such a wide net, and why not receiving a letter does not rule out being affected, particularly for families whose contact details have changed.

What families are offered and told

ETS is providing 24 months of Experian IdentityWorks at no charge, with no credit card needed. Parents or guardians of minors enroll through a Minor Plus product, and adults, including former students who are now grown, enroll in the standard product. The state’s deadline to enroll is March 19, 2027, and the activation codes and enrollment instructions sit in the notification letter, which is also posted on the department’s ETS notification page. Identity restoration help is available for 24 months from the notification date without enrolling in monitoring.

The department advises caution with unexpected emails, texts or calls about school, assessments or the incident, and says not to share Social Security numbers, passwords or financial details in response to unsolicited requests. Adults can request free credit reports at AnnualCreditReport.com and place a free security freeze, and parents may consider a free credit freeze for children under 16. A call center is open at 833-931-8488 on weekdays, and the California Department of Justice maintains identity theft resources through its privacy section.

Oversight and the open questions

The department says it has found no evidence so far that the information has been made public, based on ETS’s web monitoring. It is working with state cybersecurity experts, and the California Cybersecurity Integration Center is assisting with digital forensics and incident response. The California Department of Technology and the Governor’s Office of Emergency Services are supporting the technical, legal and operational response. The department and the State Board of Education are also reviewing ETS’s compliance with data security and contractual requirements.

A department spokesperson declined to tell The Record what steps ETS took to reduce the risk of public exposure, so how a months-long theft went unnoticed until Sept. 25 remains unexplained in the public record. The Record places the incident alongside earlier education technology breaches it has covered, among them Illuminate Education, which suggests that school data held by outside vendors is a recurring target. The department has said it will update its incident page as more information becomes available, so families should check it rather than rely on third-party summaries, and should treat any message that offers help in exchange for payment or login details as suspect.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.