The California Department of Education (CDE) has announced that an unauthorized party used a stolen login to enter a secure file transfer site that Educational Testing Service (ETS), the state’s testing contractor, uses to exchange assessment data with CDE, and copied student files at various times between May 22 and September 18, 2026. The copied data covers all students enrolled in California public schools in the three previous school years and includes names, dates of birth, home addresses, disability and Section 504 status, and state test results, but not Social Security numbers or financial account information. Students in the Irvine Unified School District (IUSD) take the state CAASPP and ELPAC assessments every year, so nearly every Irvine public school family falls within the affected group. ETS is offering 24 months of free identity protection, and the enrollment deadline is March 19, 2027.
What Happened in the ETS California State Testing Data Incident
ETS is a nonprofit assessment organization under contract with the State of California to provide state and federally required testing to all students in California public schools, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC). The timeline on the CDE page is as follows:
| Date | Event |
|---|---|
| May 22 to September 18, 2026 | An unauthorized party used a compromised login credential to access the SFTP site and copy student files at various times |
| September 25, 2026 | ETS identified the unauthorized activity, disabled the account, took the site offline, and began an investigation with outside cybersecurity experts |
| October 2, 2026 | CDE posted a letter about the ETS incident in its Incident Notices section |
| October 16, 2026 | CDE posted the ETS notification page, and notices to affected students and families began |
ETS states that it has worked with law enforcement and cybersecurity experts to reduce the risk of the data being made public, and that its regular web monitoring has not found evidence that the information has been made public. The California Cybersecurity Integration Center (Cal-CSIC) is assisting with forensics, and the California Department of Technology and the Governor’s Office of Emergency Services are supporting the response; CDE and the State Board of Education are reviewing whether ETS met its data security and contractual obligations. As reported by EdSource, law enforcement is investigating the incident.
What the ETS Data Incident Means for Irvine Families
According to CDE, affected individuals include current and former students enrolled in California public schools between 2023 and the current school year, as well as students who left a California school since 2006 and did not confirm a transfer to another school with CDE. This means current IUSD students, students who graduated from IUSD or moved to a private school in the past three years, and those among them who are now adults may all be on the list.
CDE highlights two points. First, a notification letter or email means the student’s information was included in the copied files. Second, not receiving a notification does not necessarily mean the student was unaffected, because families whose contact information has changed may not receive a letter. Families who have moved or changed email addresses should not wait for a letter and should follow the instructions on the CDE page directly.
What Student Information Was Copied in the ETS Incident
The copied information varies by student. CDE lists the following categories:
| Category | Details |
|---|---|
| Identity and enrollment | Name, date of birth, home address, school, district, grade level |
| Student identifiers | Statewide Student Identifier (SSID, a randomly generated 10-digit number assigned to each California public school student) and local student identifier |
| Demographics | Gender, race or ethnicity, primary language, country of origin, English learner status |
| Special education | Disability and Section 504 status, testing accommodations, primary disability type |
| Program eligibility | Title I (Parts A and C), McKinney-Vento, Military Connected Student |
| Assessments | English language proficiency information and state assessment registration, participation, and results |
The data did not include Social Security numbers, driver’s license numbers, passport numbers, bank account information, credit or debit card information, or account passwords. The incident also did not involve parent or guardian personal information.
How to Enroll in the Free ETS Identity Protection Service
ETS is providing 24 months of Experian IdentityWorks identity protection at no cost and with no credit card required to affected current and former students, in two versions by age:
- Under 18: A parent or legal guardian enrolls the student in the Minor Plus product with the activation code in the notification letter, on or before March 19, 2027. Students who turn 18 before March 19, 2029 may enroll in the adult product after turning 18 using the adult activation code included with the notification.
- 18 and older: Former students who are now adults enroll themselves in the adult product, also on or before March 19, 2027.
Even without enrolling in monitoring, affected individuals who experience identity theft can receive Experian identity restoration assistance for 24 months from the date of the notification. Questions go to the incident line at 833-931-8488 (Monday through Friday, 6:00 a.m. to 6:00 p.m. Pacific Time), using engagement number B174774 for students under 18 and B174775 for students 18 or over.
CDE also suggests that adults obtain free credit reports and place a free security freeze on their own credit files, and that parents consider requesting a free credit freeze for children under 16 to prevent accounts from being opened in their names.
How to Recognize Scams Related to the ETS Incident
The copied data includes school, grade level, and home address, which scammers could use to pose as a school or a testing organization. CDE advises caution with unexpected emails, text messages, or phone calls that reference a student’s school, state assessments, or this incident; not providing Social Security numbers, passwords, or financial information in response to unsolicited requests; verifying website addresses before enrolling in identity protection; and relying on the official CDE incident page when in doubt.
High school seniors are now in frequent contact with admission offices, the Common Application, and financial aid systems, so emails posing as requests to submit missing materials or verify identity are easier to click by mistake. The submission steps before early deadlines are covered in Common App Before Early Deadlines: Five Checks.
EDUBUS Recommendations on the ETS Data Incident
Enroll early rather than waiting for the deadline. Enrollment runs until March 19, 2027, but the files were copied starting in May, so monitoring is more useful the earlier it begins. Families with college students who are now adults should remind them to enroll themselves, because parents cannot enroll them in the adult product.
Consider a credit freeze for children under 16. The copied data does not include Social Security numbers, but it does include names, dates of birth, and home addresses. Requesting a free credit freeze for children under 16 is a step the CDE page specifically suggests.
Pay attention if the student has disability or Section 504 records. This information is sensitive, and parents of students with special education services or testing accommodations may ask the school counselor or the district for more information about how the data is used.
Distinguish state assessments from college admission tests. All of the data categories listed on the CDE page come from the state assessment programs. How to read CAASPP results is explained in CAASPP Results Go Public Oct 15 with New Level Names and Brief: IUSD 2025-26 CAASPP Results Released; college planning at Irvine high schools is covered in the EDUBUS Irvine high school planning guide.
Sources
- California Department of Education: Educational Testing Service (ETS) Incident (accessed October 19, 2026)
- EdSource: Personal information for 7M California students stolen following hack (accessed October 19, 2026)
- How UC Awards Credit for AP Scores: Rules by CampusUC grants graduation credit for AP scores of 3 or higher, usually 8 quarter units per exam, but each campus decides what it replaces. UC Irvine and UCLA rules compared.
- Court Pauses F-1 Four-Year Limit Rule; DHS AppealsA federal court postponed the DHS rule replacing F-1 duration of status with fixed periods of up to four years; DHS appealed September 30. What it means in Irvine.
- California Phone-Free Schools Law: IUSD Policy ExplainedAB 3216 required every California district to adopt a student smartphone policy by July 1, 2026. Irvine Unified adopted BP 5131.8 in April. What it requires of families.
- California Graduation Requirements: State vs. DistrictCalifornia sets minimum graduation requirements and lets districts add more. This guide covers the state standards, two new requirements, and the gap with UC A-G.
