ETS California Student Data Breach: What Happened and How to Protect Your Child

The California Department of Education (CDE) announced on October 16, 2026, that unauthorized actors accessed an Educational Testing Service (ETS) server, compromising the educational and demographic records of millions of California public school students. The breach occurred between May 22, 2026, and September 18, 2026, exposing student names, dates of birth, home addresses, disability records, and state assessment scores across three academic years. 

While state officials confirmed that Social Security numbers and financial account details were not accessed, exposed personal files elevate the risk of secondary phishing attacks, fraudulent account creation, and child identity theft.

How the ETS Data Breach Happened

Unauthorized actors used compromised login credentials to gain illicit access to a Secure File Transfer Protocol (SFTP) server operated by ETS. Educational Testing Service administers statewide standardized testing assessments for California public schools, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).

ETS identified the unauthorized file access on September 25, 2026, and notified school districts on October 2, 2026, before coordinating a public disclosure with the state. An internal investigation confirmed that intruders copied student files intermittently across a four-month window.

What Student Data Was Exposed in the Breach

The scope of exposed data varies by student, but involves records dating back through the 2023–2024 academic year:

Because Social Security numbers were not taken, scammers cannot automatically establish traditional lines of credit overnight. However, bad actors frequently bundle basic demographic data with records from other breaches to assemble synthetic profiles or craft convincing spear-phishing schemes aimed at families.

Warning Signs of Child Identity Theft After the Breach

Data breach exposures involving children often manifest months after the initial intrusion. Watch for these indicators that an affected student’s personal information may be circulating among scammers:

• Unsolicited calls, texts, or emails claiming to be from ETS or school officials: Legitimate state agencies will not call or text asking for your child’s Social Security number or payment to receive breach protections.
• Credit offers and pre-approved cards addressed to a minor: Children rarely have credit files, so pre-approved cards, loan offers, or rewards enrollments indicate an active file exists.
• Government and agency notices in your child’s name: Warning letters from the IRS about unpaid taxes, notifications regarding state benefits, or jury duty summonses for a minor signal identity misuse.
• Calls from collection agencies: Debt collectors demanding payment for opened utility accounts, cell phone contracts, or medical services in a student’s name point to fraudulent accounts.
• School enrollment or testing discrepancies: Notifications from educational institutions regarding unauthorized transfers, unknown state test submissions, or modified student records.

How to Protect Yourself and Your Child

Take the following concrete defensive steps to protect your child’s personal data from being weaponized:

1. Activate the state-provided identity protection coverage. ETS is offering two years of complimentary identity monitoring through Experian IdentityWorks. Parents can enroll eligible minor children at Experian IdentityWorks for Minors using the activation code provided in the official CDE breach notification.
2. Place a credit freeze on your child’s credit file. Federal law allows parents and legal guardians to freeze a credit file for children under 16 at no cost to prevent unauthorized accounts from being opened. Contact each of the three credit bureaus (Equifax, Experian, and TransUnion) directly to request a minor freeze.
3. Apply a verification test to all breach-related outreach. Scammers exploit news of large breaches to pose as test administrators, district staff, or identity support agents. If someone contacts you seeking account verification, hang up and reach out through the official California Department of Education incident portal.
4. Monitor your household’s digital accounts. Update passwords across school portal logins, parent-teacher applications, and family email accounts, pairing each with multi-factor authentication (MFA) using an authenticator app.
5. Check for existing credit files for older dependents. Students who are 18 or older can review their own credit reports for free every week at AnnualCreditReport.com to ensure no accounts have been opened under their names.

What to Do If Your Child’s Information Was Misused

If an unauthorized party uses your child’s personal details to open accounts, secure credit, or claim benefits, take immediate action to limit liability:

• Halt contact and refuse demands for payment: Never send funds or negotiate with debt collectors attempting to collect on fraudulent debts opened in a child’s name.
• Contact the fraud departments of involved companies: Reach out to the bank, merchant, or utility provider that issued the fraudulent account, notify them of child identity fraud, and demand written confirmation that the account is closed and cleared.
• File an identity theft report with the FTC: Submit an official declaration at IdentityTheft.gov. This creates an official Identity Theft Report required by banks and credit bureaus to remove fraudulent records.
• Demand immediate credit file purges: Send copies of your FTC Identity Theft Report and proof of minor custody to Equifax, Experian, and TransUnion, requesting the immediate deletion of all fraudulent tradelines and inquiries.
• File a police report: Contact your local police department if financial fraud, impersonation, or extortion occurred, and retain the incident report number for your financial documentation.
• Maintain complete paper trails: Log all correspondence, including dates, representative names, case numbers, and copies of collection letters.

How to Report the Threat and Stay Protected

Reporting incidents promptly assists regulatory authorities and cybersecurity investigators in tracking down threat actors and stopping systemic abuse. Use these verified channels:

• Federal Trade Commission (FTC): Report identity theft and recover an identity through IdentityTheft.gov, or submit general fraud reports to the FTC Fraud Reporting Portal.
• FBI Internet Crime Complaint Center (IC3): File cybercrime and data breach reports via the IC3 Portal.
• California Department of Justice: Access identity theft resources and state breach updates via the Privacy Enforcement and Protection Unit.
• Federal Communications Commission (FCC): Report suspicious caller ID spoofing or phishing robocalls on the FCC Complaints Center.
• California Department of Education Support Line: Families with questions regarding the ETS breach notification can contact the CDE assistance line at 833-931-8488.

Safeguarding student records requires active vigilance. By placing credit freezes, enrolling in complimentary monitoring, and questioning unexpected communications, families can minimize the risks associated with school vendor data security incidents.

No compromise. Promise.

Your credit, finances, and info, all kept Safer Than Safe.

Learn more