.png)
Key Points
- A hacker copied records on about 7 million California public school students from testing vendor ETS between May 22 and September 18, 2026.
- The stolen files include names, birth dates, home addresses, and disability status, but not Social Security numbers or financial account details.
- Families can enroll in free Experian monitoring through March 19, 2027, and parents can freeze credit for children under 16 at no cost.
A hacker copied personal data on roughly 7 million California public school students from Educational Testing Service. ETS runs California’s statewide CAASPP and ELPAC exams, and someone used a stolen login to reach one of its file-transfer sites between May 22 and September 18, 2026.
The files include names, birth dates, and home addresses, the core details thieves use to take out student loans in someone else’s name.
The Details
- Who’s affected: The California Department of Education says the breach covers students enrolled in a California public school from 2023 onward. Students who left since 2006 without a confirmed transfer are also included, so some victims are now adults.
- Timeline: ETS spotted the activity on September 25. The CDE alerted districts on October 2, and ETS began notifying families on October 16, according to Menlo Park City School District.
- Response: ETS took the site offline and disabled the compromised account. Outside cybersecurity experts and law enforcement are investigating, and ETS reports no evidence so far that the data has been published.
- Testing impact: ETS halted normal enrollment data processing and paused some testing work while it secures its systems.
What The ETS Breach Exposed
| Data Type | What It Includes | Exposed? |
|---|---|---|
| Basic Identity | Name, birth date, home address | Yes |
| School Records | School, district, grade, state and local student IDs | Yes |
| Demographics | Gender, race or ethnicity, language, country of origin | Yes |
| Disability Status | Disability type, Section 504 status, test accommodations | Yes |
| Program Eligibility | Title I, McKinney-Vento, military-connected status | Yes |
| Test Data | State test registration, participation, results | Yes |
| Government IDs | Social Security, driver’s license, passport numbers | No |
| Financial Data | Bank account and card numbers | No |
| Parent Information | Parent or guardian personal details | No |
Source: California Department of Education. The College Investor.
Why It Matters
Before age 18, being added as an authorized user on a parent’s card is the only real way for a child to build credit. A credit file under a child’s name is a red flag, but most families never check for one. Fraud tied to this breach could sit unnoticed until a teen applies for a first credit card or private student loan.
The breach also gives scammers better material. A fake “breach support” email that names a real school and grade level is harder to spot. The CDE warns families not to share Social Security numbers, passwords, or financial details in response to unexpected messages, the same advice that applies to common student loan scams.
What Families Should Do
- Enroll in free monitoring. ETS is paying for Experian IdentityWorks, with identity restoration help available for 24 months. Minors sign up through Experian’s Minor Plus product, and adults use the standard IdentityWorks product by March 19, 2027.
- Freeze your child’s credit. Parents can request free credit freezes for children under 16 at Equifax, Experian, and TransUnion, the CDE notes.
- Pull adult reports. Former students who are now adults can check their files for free at AnnualCreditReport.com.
- Don’t wait for a letter. A missing notice doesn’t mean a student was unaffected, especially if the family moved. The incident call center at 833-931-8488 can confirm.
How This Connects
California already faces fraud built on stolen student identities. The state’s community college system has flagged more than one million suspicious applications, and the House passed a bill in June to screen every FAFSA for identity fraud. The ETS files lack Social Security numbers, which a FAFSA application requires for most students.
What’s Next
The CDE and State Board of Education are reviewing whether ETS met the data security terms of its state contract. A CDE spokesperson told EdSource that “we expect our contractors to uphold the highest standards.” Watch for an official student count from the state and a restart date for paused testing work. Families who later find accounts they didn’t open can follow the steps to dispute fraudulent student loans.
Editor: Colin Graves
The post Hackers Stole Data On About 7 Million California Students From Testing Vendor ETS appeared first on The College Investor.
||---------------------------
By: Robert Farrington
Title: Hackers Stole Data On About 7 Million California Students From Testing Vendor ETS
Sourced From: thecollegeinvestor.com/90865/hackers-stole-data-on-about-7-million-california-students-from-testing-vendor-ets/
Published Date: Fri, 23 Oct 2026 10:30:00 +0000
Did you miss our previous article...
https://peaceofmindinvesting.com/clubs/proposed-bill-would-cut-off-federal-student-aid-to-forprofit-colleges
