Educational Testing Service (ETS), a contractor for California's statewide student assessments, reported unauthorized access to a secure file-transfer site used for California assessment data. The company discovered the incident on September 25, 2026, and public notification began on October 16, 2026. The unauthorized access occurred between May 22 and September 18, 2026, when a compromised login credential was used to copy student files.
The breach involved student names, dates of birth, addresses, schools, student identifiers, demographic information, disability and program eligibility data, and assessment results. Approximately 7 million California public-school students were affected, representing all students enrolled during the prior three school years. Social Security numbers, financial account information, passwords, and driver's license information were not exposed. The California Department of Education stated that it had not found evidence that the information was publicly posted as of the initial notification.
ETS disabled the compromised account, took the affected SFTP site offline, and began an investigation with cybersecurity experts. The company also implemented additional protective measures. The California Department of Education published an official ETS incident notification and a formal vendor incident report/incident letter. Affected students and families were to receive direct notification and two years of free identity protection. Details about the specific terms of the identity protection program are available on the statewide CDE page.