# ETS Breach May Have Exposed About 7 Million California Students

- URL: https://usa-24.com/california-student-data-breach-ets-2/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-26T00:50:15.247Z
- Updated: 2026-10-26T00:50:15.255Z
- Topics: Data Breach, Student Privacy, Educational Testing Service, Class Action, California, Cybersecurity

> Hackers had access to a testing contractor’s file-transfer site for about four months. Families of an estimated 7 million California students now face lawsuits, monitoring offers and scam risks.

## Key takeaways

- Hackers used a compromised login to copy files from an ETS secure file transfer site between May 22 and Sept. 18, 2026.
- ETS detected the unauthorized activity on Sept. 25, and the California Department of Education publicly disclosed the breach on Oct. 16.
- The exposed data reportedly includes names, birth dates, home addresses, disability and Section 504 information, and state test results, but the state says Social Security numbers were not involved.
- The roughly 7 million student figure is an outside estimate, since the state has not published an official victim count.
- Two proposed class actions have been filed in federal court, and families can enroll in free Experian monitoring through March 19, 2027.

Hackers had access for about four months to a file-transfer site run by Educational Testing Service, and the California student data breach that followed may touch roughly 7 million students. The state has not published an official victim count, so that figure comes from plaintiffs’ lawyers and a secondary news outlet. The files reportedly include names, birth dates, home addresses, disability records and state test results, which makes this more than a routine vendor incident.

ETS is the nonprofit that runs California’s CAASPP and ELPAC testing for the state. The [California Department of Education](https://www.cde.ca.gov/nr/in/ets-notification.asp) alerted school districts on Oct. 2, 2026, and disclosed the incident publicly on Oct. 16. ETS began notifying families later that same month, and two proposed class actions followed within days.

The scale is the reason this story reaches beyond California. The data covers current students and former students, and the disability and program records raise the stakes of any follow-on scam. The central question is how a single login reached this much data.

## How the California student data breach unfolded

The intruders used a compromised login to copy files from a secure file transfer (SFTP) site that ETS operated. According to the state’s notice, the access window ran from May 22 to Sept. 18, 2026. ETS spotted unauthorized activity on Sept. 25, disabled the account and took the site offline. It later built a new platform.

A file-transfer server is an attractive target because it holds bulk files in one place. One stolen credential can open many records at once, and that is the core of the criticism. [GovTech](https://www.govtech.com/education/k-12/testing-company-data-breach-affects-millions-of-calif-students) reported that experts focused on the same point: a loss this large could follow from one credential, and the reporting did not mention multi-factor protection on that account.

The key dates so far:

- May 22, 2026: Access window opens
- Sept. 18, 2026: Access window ends
- Sept. 25, 2026: ETS detects unauthorized activity and disables the account
- Oct. 2, 2026: State alerts school districts
- Oct. 16, 2026: California Department of Education discloses the incident publicly

Several gaps remain. The notice does not explain how the login was compromised, and the state has not named the attackers or their motive. [CyberInsider](https://cyberinsider.com/ets-data-breach-exposes-california-students-personal-information/) reported no ransom demand. ETS says it has found no evidence so far that the stolen data has been published, though monitoring continues, according to [Malwarebytes](https://www.malwarebytes.com/blog/data-breaches/2026/10/millions-of-california-students-sensitive-data-stolen-in-breach).

## Which data was exposed, and what was left out

Reporting on the state notice lists the exposed categories: student names, birth dates, home addresses, school and grade, statewide student IDs, demographic data, English learner status, disability and Section 504 information, program eligibility such as low-income or unhoused status, and state test results. [LAist](https://laist.com/news/education/california-student-data-breach-2026-what-do-do) summarized the categories for families.

The state says Social Security numbers, driver’s license numbers, financial account data, passwords and parent or guardian information were not involved. That narrows the risk, but it does not remove it. Disability and program data goes well beyond a name and an email address. A message that mentions a child’s learning needs or eligibility for support programs can sound far more believable to a parent than a generic alert.

Coverage reaches well beyond current classrooms. The notice reportedly covers students enrolled from 2023 onward, plus students who left since 2006 without a confirmed transfer. California had more than 5.7 million students enrolled in public schools in 2025–26, so a roughly 7 million estimate fits a window that includes former students. No official count has been published, and that gap is the first thing to watch.

## What families should do now

Start with the official notice. The steps below draw on the state notice and on outlets that reviewed it.

- Check for the official notice. Compare any letter, email or text about the breach with the California Department of Education and ETS notice before clicking links or sharing information.
- Enroll in the monitoring offer. [The College Investor](https://thecollegeinvestor.com/90865/hackers-stole-data-on-about-7-million-california-students-from-testing-vendor-ets/) reported free Experian enrollment through March 19, 2027. One local notice, reported by [Sierra News Online](https://sierranewsonline.com/student-data-breach-california-families-begin-receiving-notices/), described two years of free identity protection, so read the exact terms in your letter.
- Freeze your child’s credit where available. The College Investor reported that credit freezes for children under 16 are free, but confirm the process directly with each credit bureau.
- Watch for warning signs, including school enrollment or testing records that do not match and unexpected loan or credit notices in your child’s name.
- Be skeptical of unsolicited contact that mentions ETS, CAASPP or ELPAC. Verify with your school district first, since the notice warns of follow-on scams.

Treat legal outreach carefully. Lawyers commonly advertise free case reviews after incidents like this, and a solicitation does not confirm that your child’s record was taken. Check court filings directly. The Los Angeles complaint is listed as PL01 v. Educational Testing Service, No. 2:26-cv-12163, in the Central District of California.

## Two class actions and the state’s contract review

Two proposed class actions have been filed against ETS. One is in federal court in Los Angeles, and the second is in federal court in Northern California. [OpenClassActions](https://openclassactions.com/lawsuits/data-breaches/ets-california-student-data-breach-class-action-lawsuit.php) lists the Los Angeles case, which alleges ETS did not notice the intrusion until about a week after the last access. That timing lines up with the state’s dates: access ended Sept. 18, and ETS flagged activity on Sept. 25.

Filing dates differ by outlet. One tracker gives Oct. 17 for Los Angeles and Oct. 20 for Northern California. Another report gives Oct. 20 for a suit and Oct. 22 for a law firm press release. Until court dockets confirm the dates, treat them as unsettled.

The plaintiffs have already made their case in public. In a [Business Wire release](https://www.businesswire.com/news/home/20261022657419/en/Cotchett-Pitre-McCarthy-Files-Class-Action-Lawsuit-Against-Educational-Testing-Service-for-Unlawfully-Exposing-Private-Information-of-California-Students), Joe Cotchett, founder of Cotchett, Pitre & McCarthy, said ETS “needed the sensitive and private information of California’s young people to run its testing business.” That is a plaintiffs’ lawyer’s claim, not a finding by investigators.

On the state side, education officials said they are reviewing whether ETS complied with its contract’s data security requirements, as [GovTech reported](https://www.govtech.com/education/k-12/ets-sued-over-data-breach-affecting-current-former-calif-students). In a letter cited by reporters, state Deputy Superintendent of Public Instruction Mary Nicely said the state is “urgently working with a team of state agencies to investigate and determine scope and impact of the incident.” Whether ETS violated its contract remains an open question.

## What this breach signals for school data vendors

This breach happened inside a contractor’s system, not inside a local school district’s network. The case summary from [Emery Reddy](https://www.emeryreddy.com/blog/data-breach/educational-testing-service-data-breach) draws that line. It matters because districts and the state hand sensitive student files to outside vendors, and the vendor’s security becomes part of the district’s exposure.

Similar incidents are piling up this year. USA 24 covered the [Navigate360 breach, which exposed 8.3 million school tip records](https://usa-24.com/navigate360-data-breach-nevada-safevoice/). The common thread is sensitive records held by vendors that families rarely see.

One analysis from [Shattered.io](https://shattered.io/california-ets-breach-vendor-liability-risk-2026/) speculated that California could tighten education-vendor security rules after this case. That is one analyst’s view, not a confirmed plan, and the state notice does not commit to new requirements.

Districts that rely on outside testing platforms should ask vendors direct questions now. Ask whether logins require multi-factor authentication, how quickly intrusions get reported, and how file-transfer sites are monitored.

The next answers will come from the state and the courts. Watch for an official victim count from the state, any explanation of how the login was taken, confirmation of whether the stolen files surface online, and the outcome of the contract review. For another records case now in court, see USA 24’s coverage of [the Marines’ lawsuit over the Pentagon DMDC breach](https://usa-24.com/pentagon-data-breach-lawsuit-dmdc/).

## Frequently asked questions

### How do I know if my child was affected by the California student data breach?

The state says the breach covers students enrolled from 2023 onward, plus students who left since 2006 without a confirmed transfer. Check for the official notice from the California Department of Education and ETS. Compare any letter or email with that notice before you act on it.

### Were Social Security numbers exposed in the ETS breach?

According to the state, Social Security numbers, driver’s license numbers, financial account data, passwords and parent or guardian information were not involved. The exposed records reportedly include names, birth dates, home addresses, school and grade, state student IDs, and disability and program information. Those details can still support targeted phishing, so treat unexpected messages with caution.

### How long is the free monitoring offered after the ETS breach?

The College Investor reported free Experian enrollment through March 19, 2027, along with free credit freezes for children under 16. One local notice described two years of free identity protection, so read the terms in your letter. Enroll only through the instructions in the official notice rather than through links in unsolicited messages.

### Has the stolen ETS data been posted online?

ETS says it has found no evidence so far that the stolen data has been published. Monitoring is continuing, and the state has not released an official victim count. Watch for updates from the California Department of Education and ETS in case that changes.

### Should I respond to a law firm offering a free case review?

Lawyers commonly advertise free case reviews after incidents like this, and a solicitation does not confirm that your child’s data was taken. Verify any claim through court records, including the Los Angeles complaint listed as PL01 v. Educational Testing Service, No. 2:26-cv-12163. Do not share sensitive information until you have checked the firm’s details.

## Sources

1. [Educational Testing Service (ETS) Notification — California Department of Education](https://www.cde.ca.gov/nr/in/ets-notification.asp)
2. [Testing Company Data Breach Affects Millions of Calif. Students — GovTech (TNS)](https://www.govtech.com/education/k-12/testing-company-data-breach-affects-millions-of-calif-students)
3. [ETS Sued Over Data Breach Affecting Current, Former Calif. Students — GovTech](https://www.govtech.com/education/k-12/ets-sued-over-data-breach-affecting-current-former-calif-students)
4. [One Compromised Login Exposed Millions of California Students' Records — SecurityWeek](https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/)
5. [Hackers Stole Data On About 7 Million California Students From Testing Vendor ETS — The College Investor](https://thecollegeinvestor.com/90865/hackers-stole-data-on-about-7-million-california-students-from-testing-vendor-ets/)
6. [Cotchett, Pitre & McCarthy Files Class Action Lawsuit Against Educational Testing Service — Business Wire](https://www.businesswire.com/news/home/20261022657419/en/Cotchett-Pitre-McCarthy-Files-Class-Action-Lawsuit-Against-Educational-Testing-Service-for-Unlawfully-Exposing-Private-Information-of-California-Students)
7. [ETS Data Breach Lawsuit Over California Student Records — OpenClassActions](https://openclassactions.com/lawsuits/data-breaches/ets-california-student-data-breach-class-action-lawsuit.php)
8. [Data breach exposes California student information: How to protect your family — LAist](https://laist.com/news/education/california-student-data-breach-2026-what-do-do)
9. [Millions of California students' sensitive data stolen in breach — Malwarebytes](https://www.malwarebytes.com/blog/data-breaches/2026/10/millions-of-california-students-sensitive-data-stolen-in-breach)
10. [ETS data breach exposes California students' personal information — CyberInsider](https://cyberinsider.com/ets-data-breach-exposes-california-students-personal-information/)
11. [Student Data Breach: California Families Begin Receiving Notices — Sierra News Online](https://sierranewsonline.com/student-data-breach-california-families-begin-receiving-notices/)
12. [ETS Student Data Breach Lawsuit — Emery Reddy](https://www.emeryreddy.com/blog/data-breach/educational-testing-service-data-breach)