A massive data breach at California's primary standardized testing vendor, Educational Testing Service (ETS), has exposed the personal records of millions of public school students. First discovered on September 25, 2026, the incident shows the cybersecurity risks of third-party contractors that handle sensitive administrative and educational data. As we previously reported, this breach exposes multi-year student data sets, which raises immediate privacy concerns for families across the state.
What Happened
On September 25, 2026, ETS discovered that an unauthorized party accessed and copied files from one of its secure file transfer protocol (SFTP) servers. Under contract with the California Department of Education (CDE), ETS processes sensitive student data to coordinate statewide academic assessments. According to reporting from the Los Angeles Times, the compromised files included names, dates of birth, residential addresses, school districts, grade levels, and Statewide Student Identifiers (SSIDs).
While "SSID" usually refers to a Wi-Fi network name in cybersecurity, often targeted in evil twin phishing attacks, in this educational context it refers to the unique tracking number California assigns to students. Although the CDE stated that ETS has found no evidence of the stolen data being made public, cybersecurity analysts warn that "no evidence" does not mean the data is secure.
The Bigger Picture
This incident illustrates third-party vendor risk. While school districts often spend resources to secure local networks, they have little direct control over the databases of private contractors. Under federal law, the Family Educational Rights and Privacy Act (FERPA) only regulates vendors indirectly through school contracts. To address this gap, more than 20 states have passed direct privacy laws, according to Obtainer. For example, New York’s Education Law 2-d mandates that technology vendors align with the NIST Cybersecurity Framework and submit formal security plans.
State regulations enforce tight timelines for disclosing breaches, but vendor delays remain common. Under state-level laws, vendors are generally required to report breaches to districts "without unreasonable delay," but past incidents show compliance is inconsistent. For instance, the Federal Trade Commission penalized software provider Blackbaud after the company waited two months to disclose a breach to its education clients.
What This Means for Families
Because the ETS breach did not include Social Security numbers or financial information, some parents may assume the immediate risk is low. However, security experts warn that basic directory data is highly valuable to identity thieves. According to ExpressVPN, criminals use stolen names and birth dates to open utility accounts or apply for government benefits under a minor's clean record.
Thieves also use real student directory details to commit "synthetic identity fraud." As Greenlight explains, this occurs when an attacker pairs a child's real biographical data with a different Social Security number to build a fraudulent credit profile. Because children rarely check their credit, this type of fraud often remains undetected for up to a decade, only surfacing when a teenager is rejected for their first student loan or apartment lease.
What You Can Do
Parents can take several steps to protect their children's identity:
- You can place a free security freeze on your child's credit files, as advised by the Michigan Attorney General, to prevent unauthorized accounts.
- Ask local school boards how they audit tech contractors and if they enforce data protection agreements similar to the New York Parents' Bill of Rights protocols.
- Look out for pre-approved credit cards or debt collection letters addressed to your child, which can indicate active identity theft.