The California Department of Education (CDE) has notified students and families about a data breach at one of its contractors, Educational Testing Service (ETS). The California student data breach at ETS is a reminder that the privacy of school records depends on every company that touches them, not only on the schools themselves.
The CDE is distributing the ETS Notice of Data Breach to help ensure affected people receive information about the incident and the support available to them. Here is what has been reported so far, and what families can do about it.
What Happened at Educational Testing Service
According to reports on the incident, an unauthorized party used a compromised login to reach a file transfer site operated by ETS, the nonprofit that runs testing for the state. Coverage indicates the intruder copied student records between May 22 and September 18. That is a window of roughly four months in which a single stolen credential appears to have remained useful.
That detail matters. The incident was not described as a sophisticated break into the state's own systems. It involved a login, and a file transfer site used to move testing data between organizations. Credentials that are stolen, reused, or left without strong protections are among the most common ways attackers get into systems, and long-lived access can go unnoticed without close monitoring.
One security commentator quoted in coverage put the number of compromised student records at seven million, and described the severe business and liability risks such a compromise creates for organizations that hold student data. Exact figures may be refined as the investigation continues, so treat early numbers as preliminary.
What Student Data Was Exposed and Who Is at Risk
Reports say the stolen information includes names, birth dates, disability status, and test results of California students. Each of these carries different risks:
- Names and birth dates are core building blocks for identity theft and for convincing impersonation attempts.
- Disability status is highly sensitive. Unlike a password, it cannot be changed, and its exposure can cause harm well beyond financial fraud.
- Test results are educational records that families reasonably expect to stay private.
The people most affected are California students whose testing data passed through the ETS file transfer site, which could include current students, and potentially former students depending on how long records were kept. Young people are an especially attractive target for identity thieves because they often have no credit history, so misuse can go undetected for years.
If you received a notice from the CDE or ETS, take it seriously and read it closely. The notice is the most reliable source for what applies to you and what services are being offered.
Why Education Contractors Are a Weak Link
Schools and state agencies rarely run every system themselves. Testing, learning platforms, and data processing are often outsourced, which means student information is copied into systems run by other organizations. Each handoff creates another place where data can be exposed, and families usually have no say in which vendors are used.
This breach fits a pattern. We have covered how a second Canvas data breach disrupted exams at Penn State and beyond, another case where a technology provider serving many institutions became the point of failure. When one vendor serves millions of students, one weakness can affect all of them at once.
Three questions are worth asking of any education vendor:
- How long is data kept? Records that are no longer needed should be deleted. Old files sitting on a transfer site are a liability.
- How is access protected? A single stolen login should not be enough to reach millions of records.
- How quickly are anomalies detected? Access that persists for months suggests monitoring gaps worth examining.
What This Means For You
If you are a parent, guardian, or student in California, you do not need to panic, but you should act. The data reportedly involved is stable personal information, so the risk can last long after the news cycle moves on.
A VPN does not protect against this kind of breach, since the data was taken from a vendor's server rather than from your connection. The more useful defenses are the ones below.
- Freeze credit. A credit freeze is free and blocks most attempts to open new accounts in a student's name. Parents can generally request freezes for minors; check the credit bureaus' procedures for the process.
- Watch for phishing. Attackers who know a student's name, birth date, and school context can write very convincing messages. Be skeptical of unexpected emails or texts about testing, scholarships, or the breach itself, and go directly to official sites instead of clicking links.
- Use the support offered. If the notice includes monitoring or assistance, sign up promptly and keep a copy of the notice.
- Secure accounts. Use unique passwords and multi-factor authentication on email and school accounts, since email is often the key to resetting everything else.
- Keep records. Note dates, notices, and any suspicious activity in case you need to dispute fraud later.
Actionable Takeaways
The California student data breach at ETS shows that the strength of a school's privacy promises is limited by its weakest vendor. Families cannot fix that alone, but they can reduce the damage and press for better practices.
- Freeze credit for affected students and adults in the household.
- Treat unexpected messages about testing or the breach as suspicious until verified through official channels.
- Ask your school, district, and any vendor how long student data is retained and who has access to it.
- Follow updates from the CDE and ETS as the investigation develops.
This is not the first time education technology has been hit, and the Canvas incidents suggest it will not be the last. Staying informed, and asking direct questions about data retention, is one of the most practical steps families can take.
