Educational Testing Service (ETS) is notifying California students and families that an intruder stole personal information from a file transfer site used for statewide testing, including disability details and assessment results.
The breach includes records for all students enrolled in the three previous school years, as well as current and former students. The notification does not specify the total number of people affected.
ETS discovered unauthorized activity on September 25, 2026. An investigation involving external cybersecurity experts determined that an unauthorized party used a compromised login credential to access and copy files at various times between May 22 and September 18, 2026.
ETS is a nonprofit assessment organization contracted to provide state and federally required testing for California public school students. Its work includes the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).
The compromised secure file transfer protocol (SFTP) site was used to exchange statewide assessment information with the California Department of Education (CDE). The notification does not explain how the login credential was compromised or identify the party responsible.
The department’s incident FAQ further clarifies that affected individuals include students enrolled between 2023 and the current school year, as well as students who left a California school since 2006 without a confirmed transfer to another school.
Sensitive student records copied
The information involved varies by individual and may include:
- Names, birth dates, residential addresses, schools, districts, and grade levels.
- Statewide and local student identifiers.
- Gender, race or ethnicity, primary language, country of origin, and English learner status.
- Disability and Section 504 status, testing accommodations, and primary disability type.
- Eligibility for Title I, Part A; Title I, Part C; McKinney-Vento; and Military Connected Student programs.
- English language proficiency information, assessment registration, participation, and results.
The records did not include Social Security numbers, government identification document numbers, financial account and payment card information, or account passwords. ETS says parent and guardian personal information was also unaffected.
Nevertheless, the copied records contain sensitive information about children’s educational needs and personal circumstances, extending the privacy implications beyond the exposure of basic contact details.
Response and support
ETS disabled the compromised account, took the affected site offline, and says it has built a replacement with enhanced security controls.
Law enforcement has been notified, and California agencies are supporting the response. CDE and the State Board of Education are also reviewing ETS’s compliance with applicable security and contractual requirements.
ETS says it has taken unspecified steps to reduce the risk of public disclosure and that its web monitoring has found no evidence the information has been made public.
Affected individuals are being offered two years of free Experian IdentityWorks protection, with separate services for minors and adults. The notification lists March 19, 2027, as the enrollment deadline and says no credit card is required.
Families should follow verified enrollment instructions and remain alert to unsolicited messages referencing their school, assessments, or the breach.
Leave a Reply