{"id":238352,"date":"2026-10-21T13:37:38","date_gmt":"2026-10-21T20:37:38","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=238352"},"modified":"2026-10-21T14:05:32","modified_gmt":"2026-10-21T21:05:32","slug":"ets-california-student-data-breach-what-happened-and-how-to-protect-your-child","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/family-safety\/ets-california-student-data-breach-what-happened-and-how-to-protect-your-child\/","title":{"rendered":"ETS California Student Data Breach: What Happened and How to Protect Your Child"},"content":{"rendered":"

The California Department of Education (CDE) announced on October 16, 2026<\/a>, that unauthorized actors accessed an Educational Testing Service (ETS) server, compromising the educational and demographic records of millions of California public school students. The breach occurred between May 22, 2026, and September 18, 2026, exposing student names, dates of birth, home addresses, disability records, and state assessment scores across three academic years. <\/p>\n

While state officials confirmed that Social Security numbers and financial account details were not accessed, exposed personal files elevate the risk of secondary phishing attacks, fraudulent account creation, and child identity theft<\/a>.<\/p>\n

How the ETS Data Breach Happened<\/h2>\n

Unauthorized actors used compromised login credentials to gain illicit access to a Secure File Transfer Protocol (SFTP) server operated by ETS. Educational Testing Service administers statewide standardized testing assessments for California public schools, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).<\/p>\n

ETS identified the unauthorized file access on September 25, 2026, and notified school districts on October 2, 2026, before coordinating a public disclosure with the state. An internal investigation confirmed that intruders copied student files intermittently across a four-month window.<\/p>\n

What Student Data Was Exposed in the Breach<\/h2>\n

The scope of exposed data varies by student, but involves records dating back through the 2023–2024 academic year:<\/p>\n\n\n\n\n\n\n\n\n\n
\n

Data Category<\/b><\/p>\n<\/td>\n

\n

Exposed in ETS Breach?<\/b><\/p>\n<\/td>\n

\n

Details<\/b><\/p>\n<\/td>\n<\/tr>\n

\n

Basic Identifiers<\/b><\/p>\n<\/td>\n

\n

Yes<\/p>\n<\/td>\n

\n

Full student name, date of birth, home address, and school attended<\/p>\n<\/td>\n<\/tr>\n

\n

Academic Identifiers<\/b><\/p>\n<\/td>\n

\n

Yes<\/p>\n<\/td>\n

\n

Statewide Student Identifier (SSID) and standardized test scores<\/p>\n<\/td>\n<\/tr>\n

\n

Demographic & Special Records<\/b><\/p>\n<\/td>\n

\n

Yes<\/p>\n<\/td>\n

\n

Demographic profiles, disability records, and program eligibility files<\/p>\n<\/td>\n<\/tr>\n

\n

Social Security Numbers<\/b><\/p>\n<\/td>\n

\n

No<\/p>\n<\/td>\n

\n

Confirmed not stored on the compromised SFTP server<\/p>\n<\/td>\n<\/tr>\n

\n

Financial & Payment Data<\/b><\/p>\n<\/td>\n

\n

No<\/p>\n<\/td>\n

\n

No credit cards, banking data, or parent billing files were involved<\/p>\n<\/td>\n<\/tr>\n

\n

Parent\/Guardian Personal Data<\/b><\/p>\n<\/td>\n

\n

No<\/p>\n<\/td>\n

\n

Contact information and parent personal records were excluded<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Because Social Security numbers were not taken, scammers cannot automatically establish traditional lines of credit overnight. However, bad actors frequently bundle basic demographic data with records from other breaches to assemble synthetic profiles or craft convincing spear-phishing schemes<\/a> aimed at families.<\/p>\n

Warning Signs of Child Identity Theft After the Breach<\/h2>\n

Data breach exposures involving children often manifest months after the initial intrusion. Watch for these indicators that an affected student’s personal information may be circulating among scammers:<\/p>\n