Key Points
- A hacker copied records on about 7 million California public school students from testing vendor ETS between May 22 and September 18, 2026.
- The stolen files include names, birth dates, home addresses, and disability status, but not Social Security numbers or financial account details.
- Families can enroll in free Experian monitoring through March 19, 2027, and parents can freeze credit for children under 16 at no cost.
A hacker copied personal data on roughly 7 million California public school students from Educational Testing Service. ETS runs California’s statewide CAASPP and ELPAC exams, and someone used a stolen login to reach one of its file-transfer sites between May 22 and September 18, 2026.
The files include names, birth dates, and home addresses, the core details thieves use to take out student loans in someone else’s name.
The Details
- Who’s affected: The California Department of Education says the breach covers students enrolled in a California public school from 2023 onward. Students who left since 2006 without a confirmed transfer are also included, so some victims are now adults.
- Timeline: ETS spotted the activity on September 25. The CDE alerted districts on October 2, and ETS began notifying families on October 16, according to Menlo Park City School District.
- Response: ETS took the site offline and disabled the compromised account. Outside cybersecurity experts and law enforcement are investigating, and ETS reports no evidence so far that the data has been published.
- Testing impact: ETS halted normal enrollment data processing and paused some testing work while it secures its systems.
| Data Type | What It Includes | Exposed? |
|---|---|---|
| Basic Identity | Name, birth date, home address | Yes |
| School Records | School, district, grade, state and local student IDs | Yes |
| Demographics | Gender, race or ethnicity, language, country of origin | Yes |
| Disability Status | Disability type, Section 504 status, test accommodations | Yes |
| Program Eligibility | Title I, McKinney-Vento, military-connected status | Yes |
| Test Data | State test registration, participation, results | Yes |
| Government IDs | Social Security, driver’s license, passport numbers | No |
| Financial Data | Bank account and card numbers | No |
| Parent Information | Parent or guardian personal details | No |
Why It Matters
Before age 18, being added as an authorized user on a parent’s card is the only real way for a child to build credit. A credit file under a child’s name is a red flag, but most families never check for one. Fraud tied to this breach could sit unnoticed until a teen applies for a first credit card or private student loan.
The breach also gives scammers better material. A fake “breach support” email that names a real school and grade level is harder to spot. The CDE warns families not to share Social Security numbers, passwords, or financial details in response to unexpected messages, the same advice that applies to common student loan scams.
What Families Should Do
- Enroll in free monitoring. ETS is paying for Experian IdentityWorks, with identity restoration help available for 24 months. Minors sign up through Experian’s Minor Plus product, and adults use the standard IdentityWorks product by March 19, 2027.
- Freeze your child’s credit. Parents can request free credit freezes for children under 16 at Equifax, Experian, and TransUnion, the CDE notes.
- Pull adult reports. Former students who are now adults can check their files for free at AnnualCreditReport.com.
- Don’t wait for a letter. A missing notice doesn’t mean a student was unaffected, especially if the family moved. The incident call center at 833-931-8488 can confirm.
How This Connects
California already faces fraud built on stolen student identities. The state’s community college system has flagged more than one million suspicious applications, and the House passed a bill in June to screen every FAFSA for identity fraud. The ETS files lack Social Security numbers, which a FAFSA application requires for most students.
What’s Next
The CDE and State Board of Education are reviewing whether ETS met the data security terms of its state contract. A CDE spokesperson told EdSource that “we expect our contractors to uphold the highest standards.” Watch for an official student count from the state and a restart date for paused testing work. Families who later find accounts they didn’t open can follow the steps to dispute fraudulent student loans.
Editor: Colin Graves
Robert Farrington is the founder of The College Investor and is widely recognized as one of the nation’s leading voices on student loan debt and saving for college. He holds an MBA from UC San Diego Rady School of Management and has spent over 15 years researching, writing, and advising on student loans, 529 plans, financial aid programs, and saving and investing for young professionals.
Robert has been featured in the The New York Times, The Wall Street Journal, The Washington Post, NBC News, and Forbes, where he has been a regular personal finance contributor for over a decade. His work combines both professional expertise and personal experience – he successfully navigated his own student loan repayment journey and has helped thousands of readers do the same.
He is committed to making the intersection of personal finance and education transparent and accessible. You can learn more about Robert on the About Page or on his personal site RobertFarrington.com.