What has been confirmed

The California Department of Education’s October 2 letter initially described an incident involving systems operated by Educational Testing Service (ETS), the state’s assessment contractor. At that point, the investigation was still determining which information had been affected. The letter also reported a halt to normal enrollment-data processing and a pause in certain testing activities.

Subsequent disclosures confirmed that student information was accessed and copied. According to the official ETS breach notice, an unauthorized party used a compromised login credential to access an ETS-operated secure file transfer protocol (SFTP) site at various times between May 22 and September 18, 2026. ETS identified unauthorized activity on September 25, disabled the account, and took the site offline. The site was used to exchange California statewide assessment information with CDE.

In its October 16 announcement, CDE said notifications had begun and were expected to continue through early November. ETS reported rebuilding the transfer site with enhanced security controls. At the time of that announcement, ETS said its monitoring had found no evidence that the information had been made public. That statement does not undo the confirmed copying of the files.

Who and what information may be affected

The scope extends beyond students currently attending school. CDE’s incident FAQ identifies current and former California public-school students enrolled between 2023 and the current school year, as well as students who left a California school since 2006 without a confirmed transfer reported to CDE. Some affected former students are now adults. CDE cautions that not receiving a notice does not establish that a person was unaffected.

The ETS notice says the information varies by individual and may include:

• Names, birth dates, addresses, schools, districts, and grade levels;
• Statewide Student Identifiers (SSIDs) and local student identifiers;
• Demographic, language, and English learner information;
• Disability and Section 504 status, accommodations, and disability type;
• Certain program-eligibility information, including McKinney-Vento status; and
• Assessment registration, participation, proficiency information, and results.

The notice says Social Security numbers, financial account information, account passwords, and parent or guardian personal information were not involved.

That distinction matters, but student privacy reaches well beyond financial identifiers. Information about a child’s disability, language development, or housing circumstances deserves careful protection. CDE also identifies the SSID itself as personally identifiable information.

What families can do now

Start with CDE’s official incident page and the notification and enrollment instructions. ETS is offering affected current and former students 24 months of complimentary Experian IdentityWorks services. CDE lists March 19, 2027 as the enrollment deadline for both the minor and adult products; enrollment requires no credit card.

Families should verify unexpected messages before responding or entering personal information. CDE’s FAQ also discusses credit freezes and other protective options. Questions about the incident and assistance can be directed to 833-931-8488, Monday through Friday, 6 a.m. to 6 p.m. Pacific Time, excluding major U.S. holidays.

Practical follow-through for district data leaders

SDLA recommends using this incident to organize concrete work across departments:

1. Coordinate family communications. Give school offices, assessment staff, and district leadership the same dated explanation and official links. Include a clear path for former students and families who need translated materials. CDE’s October 16 announcement reported that the notice was available in 27 languages.
2. Keep assistance requests private. Avoid asking families to email student identifiers, birth dates, or copies of identity documents to a general mailbox. Route enrollment and eligibility questions through the official support channels.
3. Track operational effects. Maintain a shared record of affected assessments, pending data exchanges, local workarounds, and unresolved questions. Verify current instructions before changing testing plans; the October 2 pause should not be treated as a permanent status report.
4. Review transfer accounts and retained files. Inventory who can access student-data exchanges, what each account can retrieve, and how long exported files remain available. Include automated integrations and vendor-managed copies in that discussion.
5. Ask for evidence of access controls. Review multifactor authentication for human access and the controls protecting automated credentials. CISA recommends MFA, prioritizing sensitive and administrative access and stronger, phishing-resistant methods. The public ETS disclosures reviewed here do not establish whether MFA was enabled on the compromised account.

These are recommendations for local review, not findings about an individual district’s security. The confirmed incident concerns an ETS-operated transfer site; it does not, by itself, establish that a district’s student information system was compromised.

For school data leaders, the work ahead includes helping families use the available support and accounting for the student information held throughout the assessment process. A file’s purpose may be routine; the information it contains can remain deeply personal.