California Department of Education Student Data Breach via ETS

The California Department of Education has confirmed that millions of student records were accessed without authorization through a third-party file transfer service run by Educational Testing Service (ETS). The exposed information includes names, birth dates, addresses, disability status, and permanent student records spanning three school years.

Names and birth dates cannot be changed

Legal names and dates of birth are permanent identifiers. Once they are paired with addresses and other details from your student records, they remain useful for identity theft, government benefit fraud, and targeted scams for decades. Disability status adds another layer that can be exploited for fraudulent accommodation claims or to build more convincing synthetic identities.

No passwords or login credentials were exposed

This is genuinely good news. The filing lists no passwords, no hashed credentials, and no account login information. You do not need to change any passwords because of this incident. The breach involved a compromised credential used to access the file transfer site itself, not student accounts.

What the exposure enables

With a student’s full name, exact birth date, home address, and disability status, someone can attempt to open accounts, file false tax returns, apply for loans, or impersonate the student in educational or medical settings. Permanent student records can also be used to request transcripts, alter enrollment history, or support fraudulent scholarship applications years from now.

The letter is the only reliable way to know if you were affected

The California Department of Education and ETS are required to notify affected families directly, usually by mail. If you have not received a letter, your child’s information was most likely not included. However, if you have moved since the incident period of May 22, 2026 to September 18, 2026, contact the California Department of Education or ETS directly to confirm whether your records were involved.

Millions of students across three school years

The scale alone — millions of current and former students — makes this one of the largest education-sector exposures in California history. The records cover students who participated in ETS-administered testing programs during those three years. The filing does not state exactly when the unauthorized access began or how long the attacker had access before detection on September 25, 2026.

What remains under your control

While names and birth dates cannot be replaced, you can still limit how this information is used. Monitoring credit reports, placing freezes where appropriate, and watching for unexpected mail or calls remain effective defenses. Student records themselves cannot be “frozen,” but vigilance around education-related requests can reduce misuse.

Recommended actions

• Watch for a notification letter. Review all mail carefully over the coming weeks. The letter will confirm exactly which categories of information were exposed for your child and will include details about free identity protection services being offered.
• Place a credit freeze for any child who has a Social Security number. Even though SSNs are not listed in this filing, the combination of permanent identifiers makes future identity theft more likely. A freeze prevents new accounts from being opened in their name.
• Review annual credit reports for your child starting now. Request free reports from Equifax, Experian, and TransUnion once per year and look for accounts or inquiries you do not recognize.
• Monitor for suspicious education or government correspondence. Be wary of unexpected requests for transcripts, disability-related benefits, or changes to student records. Verify every such contact directly with the school or agency before responding.
• Contact ETS or the California Department of Education if you have moved recently. Provide your current address and ask them to confirm whether your records were part of the unauthorized access.

This incident shows how long student data retains value to attackers. The information taken cannot be revoked, but early monitoring and credit freezes give families the best practical protection against the risks created by this exposure.