A hacker copied personal data on roughly 7 million California public school students from Educational Testing Service. ETS runs California’s statewide CAASPP and ELPAC exams, and someone used a stolen login to reach one of its file-transfer sites between May 22 and September 18, 2026.

The files include names, birth dates, and home addresses, the core details thieves use to take out student loans in someone else’s name.

The Details

• Who’s affected: The California Department of Education says the breach covers students enrolled in a California public school from 2023 onward. Students who left since 2006 without a confirmed transfer are also included, so some victims are now adults.
• Timeline: ETS spotted the activity on September 25. The CDE alerted districts on October 2, and ETS began notifying families on October 16, according to Menlo Park City School District.
• Response: ETS took the site offline and disabled the compromised account. Outside cybersecurity experts and law enforcement are investigating, and ETS reports no evidence so far that the data has been published.
• Testing impact: ETS halted normal enrollment data processing and paused some testing work while it secures its systems.

Why It Matters

Before age 18, being added as an authorized user on a parent’s card is the only real way for a child to build credit. A credit file under a child’s name is a red flag, but most families never check for one. Fraud tied to this breach could sit unnoticed until a teen applies for a first credit card or private student loan.

The breach also gives scammers better material. A fake “breach support” email that names a real school and grade level is harder to spot. The CDE warns families not to share Social Security numbers, passwords, or financial details in response to unexpected messages, the same advice that applies to common student loan scams.

What Families Should Do

• Enroll in free monitoring. ETS is paying for Experian IdentityWorks, with identity restoration help available for 24 months. Minors sign up through Experian’s Minor Plus product, and adults use the standard IdentityWorks product by March 19, 2027.
• Freeze your child’s credit. Parents can request free credit freezes for children under 16 at Equifax, Experian, and TransUnion, the CDE notes.
• Pull adult reports. Former students who are now adults can check their files for free at AnnualCreditReport.com.
• Don’t wait for a letter. A missing notice doesn’t mean a student was unaffected, especially if the family moved. The incident call center at 833-931-8488 can confirm.

How This Connects

California already faces fraud built on stolen student identities. The state’s community college system has flagged more than one million suspicious applications, and the House passed a bill in June to screen every FAFSA for identity fraud. The ETS files lack Social Security numbers, which a FAFSA application requires for most students.

What’s Next

The CDE and State Board of Education are reviewing whether ETS met the data security terms of its state contract. A CDE spokesperson told EdSource that “we expect our contractors to uphold the highest standards.” Watch for an official student count from the state and a restart date for paused testing work. Families who later find accounts they didn’t open can follow the steps to dispute fraudulent student loans.

Editorial Disclaimer: Opinions expressed here are author’s alone, not those of any bank, credit card issuer, airlines or hotel chain, or other advertiser and have not been reviewed, approved or otherwise endorsed by any of these entities.

Comment Policy: We invite readers to respond with questions or comments. Comments may be held for moderation and are subject to approval. Comments are solely the opinions of their authors’. The responses in the comments below are not provided or commissioned by any advertiser. Responses have not been reviewed, approved or otherwise endorsed by any company. It is not anyone’s responsibility to ensure all posts and/or questions are answered.