Key Points
- A hacker copied records on about 7 million California public school students from testing vendor ETS between May 22 and September 18, 2026.
- The stolen files include names, birth dates, home addresses, and disability status, but not Social Security numbers or financial account details.
- Families can enroll in free Experian monitoring through March 19, 2027, and parents can freeze credit for children under 16 at no cost.
A hacker copied personal data on roughly 7 million California public school students from Educational Testing Service. ETS runs California’s statewide CAASPP and ELPAC exams, and someone used a stolen login to reach one of its file-transfer sites between May 22 and September 18, 2026.
The files include names, birth dates, and home addresses, the core details thieves use to take out student loans in someone else’s name.
The Details
- Who’s affected: The California Department of Education says the breach covers students enrolled in a California public school from 2023 onward. Students who left since 2006 without a confirmed transfer are also included, so some victims are now adults.
- Timeline: ETS spotted the activity on September 25. The CDE alerted districts on October 2, and ETS began notifying families on October 16, according to Menlo Park City School District.
- Response: ETS took the site offline and disabled the compromised account. Outside cybersecurity experts and law enforcement are investigating, and ETS reports no evidence so far that the data has been published.
- Testing impact: ETS halted normal enrollment data processing and paused some testing work while it secures its systems.
What The ETS Breach Exposed
Data TypeWhat It IncludesExposed? Basic IdentityName, birth date, home addressYes School RecordsSchool, district, grade, state and local student IDsYes DemographicsGender, race or ethnicity, language, country of originYes Disability StatusDisability type, Section 504 status, test accommodationsYes Program EligibilityTitle I, McKinney-Vento, military-connected statusYes Test DataState test registration, participation, resultsYes Government IDsSocial Security, driver’s license, passport numbersNo Financial DataBank account and card numbersNo Parent InformationParent or guardian personal detailsNo
Source: California Department of Education. The College Investor.
Why It Matters
Before age 18, being added as an authorized user on a parent’s card is the only real way for a child to build credit. A credit file under a child’s name is a red flag, but most families never check for one. Fraud tied to this breach could sit unnoticed until a teen applies for a first credit card or private student loan.
The breach also gives scammers better material. A fake “breach support” email that names a real school and grade level is harder to spot. The CDE warns families not to share Social Security numbers, passwords, or financial details in response to unexpected messages, the same advice that applies to common student loan scams.
What Families Should Do
- Enroll in free monitoring. ETS is paying for Experian IdentityWorks, with identity restoration help available for 24 months. Minors sign up through Experian’s Minor Plus product, and adults use the standard IdentityWorks product by March 19, 2027.
- Freeze your child’s credit. Parents can request free credit freezes for children under 16 at Equifax, Experian, and TransUnion, the CDE notes.
- Pull adult reports. Former students who are now adults can check their files for free at AnnualCreditReport.com.
- Don’t wait for a letter. A missing notice doesn’t mean a student was unaffected, especially if the family moved. The incident call center at 833-931-8488 can confirm.
How This Connects
California already faces fraud built on stolen student identities. The state’s community college system has flagged more than one million suspicious applications, and the House passed a bill in June to screen every FAFSA for identity fraud. The ETS files lack Social Security numbers, which a FAFSA application requires for most students.
What’s Next
The CDE and State Board of Education are reviewing whether ETS met the data security terms of its state contract. A CDE spokesperson told EdSource that “we expect our contractors to uphold the highest standards.” Watch for an official student count from the state and a restart date for paused testing work. Families who later find accounts they didn’t open can follow the steps to dispute fraudulent student loans.
Robert Farrington is the founder of The College Investor and is widely recognized as one of the nation’s leading voices on student loan debt and saving for college. He holds an MBA from UC San Diego Rady School of Management and has spent over 15 years researching, writing, and advising on student loans, 529 plans, financial aid programs, and saving and investing for young professionals.
Robert has been featured in the The New York Times, The Wall Street Journal, The Washington Post, NBC News, and Forbes, where he has been a regular personal finance contributor for over a decade. His work combines both professional expertise and personal experience – he successfully navigated his own student loan repayment journey and has helped thousands of readers do the same.
He is committed to making the intersection of personal finance and education transparent and accessible. You can learn more about Robert on the About Page or on his personal site RobertFarrington.com.
Editorial Disclaimer: Opinions expressed here are author’s alone, not those of any bank, credit card issuer, airlines or hotel chain, or other advertiser and have not been reviewed, approved or otherwise endorsed by any of these entities.
Comment Policy: We invite readers to respond with questions or comments. Comments may be held for moderation and are subject to approval. Comments are solely the opinions of their authors’. The responses in the comments below are not provided or commissioned by any advertiser. Responses have not been reviewed, approved or otherwise endorsed by any company. It is not anyone’s responsibility to ensure all posts and/or questions are answered.
