California student data breach: what parents should do now

What happened

ETS runs California's statewide assessments, including the CAASPP and ELPAC tests, under contract with the California Department of Education (CDE). ETS says it found unauthorized activity on September 25, 2026, on a secure file transfer site it uses to exchange test information with CDE. Someone had used a compromised login to access the site and copy student files at various times between May 22 and September 18, 2026.

ETS disabled the account, took the site offline, brought in outside cybersecurity experts, and notified law enforcement. It says it has found no evidence so far that the information has been made public. The state's cybersecurity teams are assisting, and CDE says it is reviewing whether ETS met its data security obligations.

The notice covers all students enrolled in the three previous school years, and some others who took state tests. No total has been published, but California public schools enroll more than 5.7 million students in a single year, so this is likely one of the largest breaches of student data in the state's history.

What information was exposed

• Name, date of birth, and home address
• School, district, and grade level
• Statewide Student Identifier (SSID) and local student ID
• Gender, race or ethnicity, primary language, country of origin, and English learner status
• Disability and Section 504 status, testing accommodations, and primary disability type
• Participation in programs such as Title I, McKinney-Vento (homeless students), and Military Connected Student programs
• English proficiency and statewide test registration, participation, and results

What was included varies by student. CDE says Social Security numbers, driver's license and passport numbers, financial account and card information, and passwords were not involved, and that no parent or guardian information was involved.

What to do now

1. Enroll your child in the free 24-month Experian IdentityWorks protection. Use the enrollment link and activation code listed on the Department of Education's official notice page. There are separate codes for students under 18 and students 18 and older. The deadline for minors is March 19, 2027. No credit card is required.
2. Only enroll through links on the official CDE page. CDE warns that fake identity protection sites may appear, and scammers often copy breach offers.
3. Be alert for emails, texts, and calls that mention your child's school, teacher, test scores, or this incident. Because the stolen data is detailed, scam messages can look very convincing. Don't share passwords, codes, or payment details, and call the school or district at a number you already have.
4. Consider a free credit freeze for your child at Equifax, Experian, and TransUnion. Social Security numbers weren't taken, so this is extra protection rather than urgent, but a child's identity can be misused for years before anyone notices.
5. If your child is 18 or older, they can enroll themselves using the adult code and check their own credit reports for free at AnnualCreditReport.com.

Can you get this data deleted?

Not in the usual way. State privacy laws that let you ask companies to delete your data generally don't apply to government agencies like the Department of Education, or to nonprofits like ETS. Schools are required to keep student records. What you can do is ask your school district which student information it shares with testing and technology vendors, and how long those vendors keep it. Fewer copies in fewer places means less to steal next time.

Your legal right to deletion

For businesses you deal with directly, such as apps, stores, and streaming services, residents of states with consumer privacy laws can generally ask for their data to be deleted. See California's privacy law and what your state's law requires.

Sources: California Department of Education notice, California Attorney General breach notice, and Malwarebytes. DataTrail isn't affiliated with ETS or the California Department of Education. This page is general information, not legal advice.