A major security breach at third-party testing vendor Educational Testing Service (ETS) has compromised the personal information of millions of California public school students. The incident went undetected for four months, exposing the cybersecurity risks schools face when sharing student records with outside providers. As we previously reported, the breach prompted state officials to offer credit monitoring services to affected families.
What Happened
According to the California Department of Education, unauthorized individuals used compromised credentials to access an ETS secure file transfer protocol (SFTP) site repeatedly between May 22, 2026, and September 18, 2026. This breach, discovered on September 25, affected records from the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC). While ETS has not released an exact count of affected individuals, the data includes records of students enrolled during the past three school years. With over 5.7 million students enrolled annually in California public schools, officials warn the breach could impact up to 17 million individuals. Stolen details include student names, dates of birth, home addresses, school districts, grade levels, and Statewide Student Identifiers (SSIDs).
The Bigger Picture
This incident is part of a growing pattern of vulnerabilities in educational technology. A report on campus security baselines notes that third-party vendors were involved in 40% of all cybersecurity breaches within educational services in 2026. Security experts say districts must enforce strict protocols, such as multi-factor authentication (MFA) and single sign-on (SSO) integrations, to protect against compromised credentials. Regulatory bodies are also paying closer attention to these vendor risks. For instance, the UK Information Commissioner's Office found widespread data-protection issues among EdTech suppliers and called for formal certification regimes to protect student data.
What This Means for Families
For parents, the primary concern is child identity theft. According to the Federal Trade Commission, minors generally do not have credit reports. This makes it easy for identity thieves to use their clean records to open fraudulent accounts undetected. This breach did not expose Social Security numbers, passwords, or financial details, according to the California Department of Education's official announcement. The state also confirmed that ETS is offering affected students 24 months of free identity protection services through Experian.
What You Can Do
Parents can protect their children by taking several direct steps. First, you can request a free credit freeze from the three major credit bureaus to prevent unauthorized accounts from being opened, as recommended by state attorneys general.
Next, monitor for warning signs of child identity theft. These include unexpected bills, credit card offers, or debt collection calls addressed to your child.
Finally, if you receive a breach notification letter, activate the free 24-month monitoring service provided by ETS to track potential exposure.