A significant data breach involving a state testing contractor has compromised the personal information of millions of current and former California public school students. This incident raises questions about the security of student records and access to sensitive information.
Details of the Data Breach
The breach involves Educational Testing Service (ETS), in partnership with the California Department of Education. Hackers gained access to ETS’s secure file transfer site, exploiting a compromised login credential. Data was copied from the site over several months in 2026.
ETS discovered the intrusion on September 25, disabling the affected account and involving cybersecurity experts. The company has since strengthened its security protocols but confirmed unauthorized access and data copying.
Information at Risk
The stolen data includes much more than test scores:
- Student names and birth dates
- Home addresses and school information
- Identification numbers and language status
- Disability information and testing accommodations
Importantly, Social Security numbers and financial details were not compromised. However, the available data can still lead to identity risks.
Extent of the Breach
The breach affects students enrolled over the past three school years and some former students from as far back as 2006. This means individuals across the U.S. might still be affected if they attended school in California during those times.
ETS has started notifying affected individuals and offering free identity protection services. Notifications will continue until early November 2026.
Protective Measures
Here are some steps to protect your child’s information:
- Verify Notifications: Confirm the source of any breach-related communications before responding.
- Identity Protection: Enroll in the free services provided for identity theft protection.
- Credit Freeze: Consider freezing your child’s credit to prevent unauthorized uses.
- Monitor Communications: Be vigilant about suspicious messages requesting personal information.
- Data Removal Services: Use services that remove personal data from broker websites.
- Check Credit Reports: Review credit reports for signs of misuse or fraud.
- School Record Policies: Inquire with schools about their data retention policies and security measures.
Investigation and Future Measures
The California Department of Education and other agencies are reviewing ETS’s security practices. Ongoing monitoring aims to prevent further misuse of stolen data.
The breach highlights the need for clear policies on data retention and protection. Parents and former students have a right to understand what information is kept and for how long.