California starts notifying families in ETS student data breach

California has moved into the family-notification phase of the Educational Testing Service data breach that exposed student information tied to the state’s testing system, a shift that matters because it turns a contractor cybersecurity incident into a direct school-community problem. In a news release issued October 16, the California Department of Education said ETS had begun notifying affected current and former public school students and families that their information was accessed and copied from an ETS-operated file-transfer site, with notices expected to continue through early November.

What changed on Friday is not the existence of the breach, which state officials first disclosed to county and district leaders in an October 2 incident letter, but the start of individualized outreach. In that earlier letter, the state said ETS had halted normal enrollment-data processing and paused certain testing activities while investigators worked to determine the scope and impact. The October 16 update adds the concrete details districts and families had been waiting for: what kinds of information may have been exposed, what was not exposed, and what support is now available.

The official incident page says the accessed and copied files contained information about California students, “including but not limited to all students enrolled in the three previous school years,” and that ETS supports the state’s California Assessment of Student Performance and Progress and English Language Proficiency Assessments for California. The state has not posted an official total of affected people. But California reported 5,731,260 public school students enrolled in 2025–26, so the universe of current and former students touched by the breach almost certainly runs into the millions, even if the final official count ends up smaller or is broken out differently. That uncertainty is important for district leaders: they should prepare for broad family concern without overstating a number the state has not yet verified.

More than names: why the exposed fields matter

According to the October 16 release, the information involved varies by student but may include names, Statewide Student Identifier numbers, dates of birth, addresses, demographic information, disability information, program-participation information, and statewide assessment information. In other words, this was not limited to directory data. It reached into the records that tell the state and its testing vendor who a student is, what supports they qualify for, and how they participated in statewide assessments. (cde.ca.gov)

The state also said some categories that typically trigger the most immediate fraud alarms were not involved: Social Security numbers, financial-account information, passwords, and parent or guardian information. CDE added that, after working with law enforcement and cybersecurity experts, ETS has so far found no evidence that the information has been made public. That is an important reassurance, but it is not the same as a declaration that the risk has passed. A dataset that combines names, birth dates, addresses, student identifiers, and sensitive school-related attributes can still make impersonation attempts and highly believable phishing much easier. For schools, the practical risk is likely to show up first as confused families asking whether a message is real and what they should do next. (cde.ca.gov)

That sensitivity is especially acute because the affected information includes fields tied to disability and program participation. Even if those data never appear publicly, their compromise raises a different kind of harm than a routine password reset: it touches protected student characteristics and services that families reasonably expect schools and their contractors to guard with exceptional care. For education leaders, this is a reminder that student-data governance is not only about identity theft. It is also about whether families believe the institutions around them can handle special-education, language-status, and assessment records responsibly. (cde.ca.gov)

Districts did not cause this breach, but they will carry much of the communication load

CDE said ETS is offering affected current and former students two years of free identity-protection services through Experian IdentityWorks, and the department said the breach notice has been posted online in 27 languages. The state’s incident page also makes clear that former students, including people who are now adults, may be affected and are eligible for notification and support if their information was accessed and copied. That matters in practice because schools will be hearing not only from current families but also from graduates and former enrollees whose connection to the district may be years old and much thinner. (cde.ca.gov)

This is the part of the story that state and vendor statements do not fully capture: once letters start arriving, family-engagement offices, front desks, assessment coordinators, and principals become the de facto help system. Parents do not experience a vendor breach as an abstract contract failure. They experience it as a school problem because the records are about their child’s school life, and the names they recognize are CAASPP, ELPAC, and the local school or district. Districts therefore need a plain-language response now: how to verify that a notice is legitimate, where families can find the official state page, what information was and was not involved, and what the free monitoring offer does and does not do. (cde.ca.gov)

The broader policy lesson is uncomfortable. California already requires districts, county offices, and charter schools to report cyberattacks to the California Cybersecurity Integration Center, and the October 2 state letter said CDE and the State Board of Education were working with state cybersecurity partners on this incident. Yet this breach still appears to have turned on a compromised credential in a routine file-transfer environment. For school systems, that is a warning to look past the obvious classroom apps and ask harder questions about contractors’ back-end data exchanges, credential controls, retention practices, and how much sensitive student information needs to sit in transfer repositories at all.

What officials know now, and what they still have not said

The official timeline is clearer than the official headcount. On the incident page, CDE says ETS identified unauthorized activity on September 25, disabled the account involved, took the affected secure file-transfer protocol site offline, and opened an investigation with outside cybersecurity experts. That investigation found that an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026. The October 16 release adds that ETS has built a new SFTP site with enhanced security controls and is evaluating additional steps. (cde.ca.gov)

What remains unresolved is just as consequential. The state has not published an exact number of affected current and former students. It has not publicly described any confirmed misuse of the data. And while officials say monitoring has found no evidence that the information has been made public, they are still describing the investigation as active and the scope as something that has been assessed through ongoing coordination with ETS, law enforcement, and cybersecurity partners. District leaders should read that as a reason to keep their messaging factual and updateable, not one-and-done. (cde.ca.gov)

There is also evidence that the fallout is not limited to privacy notices. On October 2, CDE told district leaders that ETS had paused some testing activities and normal enrollment-data processing. In a separate October 7 letter about English learner identification and funding calculations, the department acknowledged that the “current interruption in testing and data processing” could affect local educational agencies’ ability to meet some requirements, even as it said the state’s funding change would keep districts from losing money over the timing issue. That is a telling second-order effect: when a statewide assessment vendor is disrupted, consequences can spill into compliance calendars and operational reporting far beyond the initial breach notice. (cde.ca.gov)

For now, the immediate task for schools is less about forensics than about readiness. Families will want to know whether their child was affected, whether the notice is real, and whether the absence of Social Security numbers means they can safely ignore the incident. Schools cannot answer every vendor-side question yet. But they can point families to the official state resources, explain the support that is being offered, and prepare for the next likely developments: an official affected count, any confirmed misuse findings, and additional guidance on testing and data-processing disruptions as notifications continue into early November. (cde.ca.gov)