Skip to main content
California Department of Education Logo

Educational Testing Service (ETS) Notification

For more information about the ETS data security incident, including frequently asked questions and available resources, visit CDE's ETS Incident Information page.

Notice of Data Breach

Educational Testing Service (ETS), at the direction of the California Department of Education (CDE), is notifying California students and families about a data security incident involving unauthorized access to and copying of student data from an ETS secure file transfer protocol (SFTP) site, the steps being taken to protect their personal information, and available resources and support. Appropriate law enforcement agencies have been notified, but their investigations have not delayed this notice.

ETS is a nonprofit assessment organization under contract with the State of California to provide state and federally required testing to all students enrolled in California public schools. ETS supports California’s statewide assessment programs, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).

We are notifying you because you or your minor dependent’s personal information was accessed and copied during this data security incident.

To help protect affected current and former students, ETS is providing complimentary identity-protection services through Experian IdentityWorks for 2 years.

What Happened?

On September 25, 2026, ETS identified unauthorized activity involving an SFTP site used to exchange California statewide assessment information with CDE.

ETS disabled the account involved, took the affected SFTP site offline, and initiated an investigation with the assistance of external cybersecurity experts. The investigation determined that an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026 to access the SFTP site to copy files containing California student information.

What Information Was Involved?

Information about California students, including but not limited to all students enrolled in the three previous school years, was accessed and copied. The information that was accessed and copied contained student demographic, program participation, and assessment data that ETS maintains in connection with California's statewide assessment programs.

The student information accessed and copied varies by individual, but may include:

  • Student name, date of birth, residential address, school, district, and grade level;
  • Statewide Student Identifier (SSID) and local student identifier;
  • Gender, race or ethnicity, primary language, country of origin, and English learner status;
  • Disability and Section 504 status, testing accommodations, and primary disability type;
  • Eligibility status for the following programs: Title I, Part A; Title I, Part C; McKinney-Vento; and Military Connected Student; and/or
  • English language proficiency information and statewide assessment registration, participation, and results, where applicable.

The data accessed and copied did not include Social Security numbers, driver’s license numbers, passport numbers, financial account information, credit or debit card information, or account passwords. The incident did not involve parent or guardian personal information.

What We Are Doing

ETS Response

Following discovery of the incident, ETS has taken numerous measures to enhance the security of the SFTP site, including taking the SFTP site offline and building an entirely new SFTP site with enhanced security controls. ETS continues to evaluate additional security measures that may be appropriate.

After working with law enforcement as well as with cybersecurity experts, ETS has taken steps to reduce the potential risk of the data being made publicly accessible. Furthermore, ETS, following regular web monitoring, has, to date, not uncovered any evidence that the information has been made public.

State Response

CDE and the State Board of Education (SBE) are working with state cybersecurity experts to assess the effect on California students and families and so that affected individuals receive appropriate information and support.

The California Cybersecurity Integration Center (Cal-CSIC) is assisting with digital forensics and incident response support. The California Department of Technology (CDT) and California Governor’s Office of Emergency Services (Cal OES) are also supporting the state’s technical, legal, and operational response.

CDE and SBE are also reviewing the incident and ETS’s compliance with applicable data security and contractual requirements.

Complimentary Identity-Protection Services Through Experian

To help protect affected current and former students, ETS is providing identity-protection services through Experian IdentityWorks for 2 years at no cost to you.

Two identity-protection services packages are available, one for minors and one for current and former students who are now adults.

Minor Plus - For affected students under age 18: A parent or legal guardian can enroll the student in the available minor identity-protection services on or before the enrollment deadline on March 19, 2027. Minors who turn 18 between now and March 19, 2029 may enroll in the adult product upon their 18th birthday by using the adult product activation code. For information on how to sign minors up for this product, see the Attachment to this Notice.

Adult - For affected individuals age 18 or older: Affected adults can enroll directly in the available Experian IdentityWorks services before the enrollment deadline on or before March 19, 2027. For information on how to sign up for this product as an adult, see the Attachment to this Notice.

There is no cost to you to enroll, and no credit card information will be requested.

What You Can Do

We encourage you to consider enrolling affected students in the identity protection services and remain alert to possible misuse of student personal information. Be cautious of fake identity protection sites by double checking URLs before providing information.

It is always best practice to be cautious of unexpected emails, text messages, or phone calls that reference a student's school, statewide assessments, or this incident. Do not share personal information, passwords, or financial information in response to unsolicited requests.

Affected students and their families may also consider reviewing additional information about identity theft and protecting personal information available from the California Department of Justice’s Privacy Enforcement and Protection Unit at www.oag.ca.gov/privacy.

For More Information

CDE, 1430 N Street, Sacramento, CA 95814, has established www.cde.ca.gov/ets with information and updates about this data security incident. The webpage will be updated if additional information becomes available. This notification is available in multiple languages on the webpage.

ETS takes the security of student information with the utmost seriousness, and sincerely regrets this incident occurred. If you have questions about this incident, please call 833-931-8488, Monday through Friday, 6:00 a.m. to 6:00 p.m. Pacific Time, excluding major U.S. holidays. If you have a speech or hearing impairment and use a TTY, please call 711. Please be prepared to provide your engagement number, B174774 for students under 18, or, B174775 for students 18 or over.

Notification Translations

FOR STUDENTS UNDER 18 - ADDITIONAL DETAILS REGARDING THE 24-MONTH EXPERIAN IDENTITYWORKS MEMBERSHIP

To help protect your minor dependent’s identity, we are offering complimentary access to Experian IdentityWorksSM for 24 months.

If you believe there was fraudulent use of your minor dependent’s information as a result of this incident and would like to discuss how you may be able to resolve those issues, please reach out to an Experian agent. If, after discussing your situation with an agent, it is determined that identity restoration support is needed, then an Experian Identity Restoration agent is available to work with you to investigate and resolve each incident of fraud that occurred from the date of the incident (including, as appropriate, helping you with contacting credit grantors to dispute charges and close accounts; assisting you in placing a freeze on your credit file with the three major credit bureaus; and assisting you with contacting government agencies to help restore your identity to its proper condition).

Please note that Identity Restoration is available to you for 24 months from the date of this letter and does not require any action on your part at this time. The Terms and Conditions for this offer are located at www.ExperianIDWorks.com/restoration.

While identity restoration assistance is immediately available to you, we also encourage you to activate the fraud detection tools available through Experian IdentityWorks as a complimentary 24-month membership. This product provides you with superior identity detection and resolution of identity theft. To start monitoring your minor dependent’s personal information, please follow the steps below:

  • Ensure that you enroll by March 19, 2027 (Your code will not work after this date.)
  • Visit the Experian IdentityWorks website to enroll: https://www.experianidworks.com/minorplus
  • Provide your activation code: RSWMV3F3N
  • Provide your minor child’s information when prompted

If you have questions about the product, need assistance with Identity Restoration that arose as a result of this incident or would like an alternative to enrolling in Experian IdentityWorks online, please contact Experian’s customer care team at 833-931-8488 by March 19, 2027. Be prepared to provide engagement number B174774 as proof of eligibility for the Identity Restoration services by Experian.

ADDITIONAL DETAILS REGARDING YOUR STUDENT’S 24-MONTH EXPERIAN IDENTITYWORKS MEMBERSHIP

A credit card is not required for enrollment in Experian IdentityWorks.

You can contact Experian immediately regarding any fraud issues, and have access to the following features once you enroll in Experian IdentityWorks:

  • Social Security Number Trace: Monitoring to determine whether enrolled minors in your household have an Experian credit report. Alerts of all names, aliases and addresses that become associated with your minor’s Social Security Number (SSN) on the Experian credit report.
  • Internet Surveillance: Technology searches the web, chat rooms & bulletin boards 24/7 to identify trading or selling of your personal information on the Dark Web.
  • Identity Restoration: Identity Restoration specialists are immediately available to help you address credit and non-credit related fraud.
  • Experian IdentityWorks ExtendCARETM: You receive the same high-level of Identity Restoration support even after your Experian IdentityWorks membership has expired.
  • $1 Million Identity Theft Insurance*: Provides coverage for certain costs and unauthorized electronic fund transfers.

FOR STUDENTS 18 AND OVER - ADDITIONAL DETAILS REGARDING THE 24-MONTH EXPERIAN IDENTITYWORKS MEMBERSHIP

To help protect your identity, we are offering a complimentary 24-month membership of Experian IdentityWorksSM. This product provides you with superior identity detection and resolution of identity theft. To activate your membership and start monitoring your personal information please follow the steps below:

This product provides you with internet surveillance, and identity theft insurance at no cost to you upon enrollment.

  • Ensure that you enroll by March 19, 2029 (Your code will not work after this date.)
  • Visit the Experian IdentityWorks website to enroll: https://www.experianidworks.com/identity
  • Provide your activation code: N8MDNZPJD

If you have questions about the product, need assistance with identity restoration or would like an alternative to enrolling in Experian IdentityWorks online, please contact Experian’s customer care team at 833-931-8488 by March 19, 2027. Be prepared to provide engagement number B174775 as proof of eligibility for the identity restoration services by Experian.

ADDITIONAL DETAILS REGARDING YOUR 24-MONTH EXPERIAN IDENTITYWORKS MEMBERSHIP

A credit card is not required for enrollment in Experian IdentityWorks.

You can contact Experian immediately regarding any fraud issues, and have access to the following features once you enroll in Experian IdentityWorks:

  • Internet Surveillance: Technology searches the web, chat rooms & bulletin boards 24/7 to identify trading or selling of your personal information on the Dark Web.
  • Identity Restoration: Identity Restoration specialists are immediately available to help you address credit and non-credit related fraud.
  • Experian IdentityWorks ExtendCARETM: You receive the same high-level of Identity Restoration support even after your Experian IdentityWorks membership has expired.
  • $1 Million Identity Theft Insurance*: Provides coverage for certain costs and unauthorized electronic fund transfers.

*The Identity Theft Insurance is underwritten and administered by American Bankers Insurance Company of Florida, an Assurant company. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions.

If you believe there was fraudulent use of your information and would like to discuss how you may be able to resolve those issues, please reach out to an Experian agent at 833-931-8488. If, after discussing your situation with an agent, it is determined that Identity Restoration support is needed, then an Experian Identity Restoration agent is available to work with you to investigate and resolve each incident of fraud that occurred (including, as appropriate, helping you with contacting credit grantors to dispute charges and close accounts; assisting you in placing a freeze on your credit file with the three major credit bureaus; and assisting you with contacting government agencies to help restore your identity to its proper condition).
Please note that this Identity Restoration support is available to you for 24 months from the date of this letter and does not require any action on your part at this time. The Terms and Conditions for this offer are located at www.ExperianIDWorks.com/restoration. You will also find self-help tips and information about identity protection at this site.

Information About Identity Theft Protection Guide

Contact information for the three nationwide credit reporting companies is as follows:

Equifax Experian TransUnion
Phone: 1-800-685-1111
P.O. Box 740256
Atlanta, Georgia 30348
www.equifax.com

 Phone: 1-888-397-3742
P.O. Box 9554
Allen, Texas 75013
www.experian.com

 Phone: 1-833-799-5355
P.O. Box 2000
Chester, PA 19016
www.transunion.com
Free Credit Report

We remind you to be vigilant for incidents of fraud or identity theft by reviewing your account statements and free credit reports for any unauthorized activity. If you identify any unauthorized charges on your financial account statements, you should immediately report any such charges to your financial institution. You may obtain a copy of your credit report, free of charge, once every 12 months from each of the three nationwide credit reporting companies. To order your annual free credit report, please visit www.annualcreditreport.com or call toll free at 1-877-322-8228. You can also order your annual free credit report by mailing a completed Annual Credit Report Request Form (available from the U.S. Federal Trade Commission’s (“FTC”) website at www.consumer.ftc.gov) to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281.

For Colorado, Georgia, Maine, Maryland, Massachusetts, New Jersey, Puerto Rico, and Vermont residents: You may obtain one or more (depending on the state) additional copies of your credit report, free of charge. You must contact each of the credit reporting agencies directly to obtain such additional report(s).

Security Freeze

Security freezes, also known as credit freezes, restrict access to your credit file, making it harder for identity thieves to open new accounts in your name. You can freeze and unfreeze your credit file for free. You also can get a free freeze for your children who are under 16. And if you are someone’s guardian, conservator or have a valid power of attorney, you can get a free freeze for that person, too.

How will these freezes work? Contact all three of the nationwide credit reporting agencies – Equifax, Experian, and TransUnion. If you request a freeze online or by phone, the agency must place the freeze within one business day. If you request a lift of the freeze, the agency must lift it within one hour. If you make your request by mail, the agency must place or lift the freeze within three business days after it gets your request. You also can lift the freeze temporarily without a fee.

The following information must be included when requesting a security freeze (note that if you are requesting a credit report for your spouse, this information must be provided for him/her as well): (1) full name, with middle initial and any suffixes; (2) Social Security number; (3) date of birth; (4) current address and any previous addresses for the past five years; and (5) any applicable incident report or complaint with a law enforcement agency or the Registry of Motor Vehicles. The request must also include a copy of a government-issued identification card and a copy of a recent utility bill or bank or insurance statement.

It is essential that each copy be legible, display your name and current mailing address, and the date of issue.

For Colorado and Illinois residents: You may obtain information from the credit reporting agencies and the FTC about security freezes.

For New Mexico residents: You may obtain a security freeze on your credit report to protect your privacy and ensure that credit is not granted in your name without your knowledge. You may submit a declaration of removal to remove information placed in your credit report as a result of being a victim of identity theft. You have a right to place a security freeze on your credit report or submit a declaration of removal pursuant to the Fair Credit Reporting and Identity Security Act. For more information, including information about additional rights, go to www.consumerfinance.gov/learnmore or write to: Consumer Financial Protection Bureau, 1700 G Street N.W., Washington, DC 20552.

Fraud Alerts

A fraud alert tells businesses that check your credit that they should check with you before opening a new account. An initial fraud alert stays on your credit report for one year. You may have an extended alert placed on your credit report if you have already been a victim of identity theft with the appropriate documentary proof. An extended fraud alert stays on your credit report for seven years. To place a fraud alert on your credit reports, contact one of the nationwide credit bureaus. A fraud alert is free. The credit bureau you contact must tell the other two, and all three will place an alert on their versions of your report.

For Colorado and Illinois residents: You may obtain additional information from the credit reporting agencies and the FTC about fraud alerts.

Federal Trade Commission and State Attorneys General Offices

If you believe you are the victim of identity theft or have reason to believe your personal information has been misused, you should immediately contact the Federal Trade Commission and/or the Attorney General’s office in your home state. You may also contact these agencies for information on how to prevent or avoid identity theft. You may contact the Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue, NW, Washington, DC 20580, www.ftc.gov/bcp/edu/microsites/idtheft/, 1-877-IDTHEFT (438-4338).

For Connecticut Residents: You may contact and obtain information from your state attorney general at: Connecticut Attorney General’s Office, 55 Elm Street, Hartford, CT 06106, 1-860-808- 5318, www.ct.gov/ag.

For District of Columbia Residents: You may contact the Office of the Attorney General for the District of Columbia, 441 4th Street NW, Suite 1100 South, Washington, D.C. 20001, https://oag.dc.gov, 202-442-9828.

For Maryland Residents: You may contact the Maryland Office of the Attorney General, Consumer Protection Division, 200 St. Paul Place, Baltimore, MD 21202, https://www.marylandattorneygeneral.gov, 1-888-743-0023.

For New York Residents: You may contact the New York Department of State Division of Consumer Protection, One Commerce Plaza, 99 Washington Ave., Albany, NY 12231-0001, 518-474-8583 / 1-800-697-1220, http://www.dos.ny.gov/consumerprotection; and New York State Office of the Attorney General, The Capitol, Albany, NY 12224-0341, 1-800-771-7755, https://ag.ny.gov.

For North Carolina Residents: You may contact the North Carolina Office of the Attorney General, Consumer Protection Division, 9001 Mail Service Center, Raleigh, NC 27699- 9001, www.ncdoj.gov, 1-877-566-7226.

For Rhode Island Residents: You may contact the Rhode Island Office of the Attorney General, 150 South Main Street, Providence, RI 02903, http://www.riag.ri.gov, 401-274- 4400.

For Texas Residents: You may contact and obtain information from your state attorney general at: Office of the Texas Attorney General www.texasattorneygeneral.gov/consumer-protection/identity-theft or contact the Identity Theft Hotline at 800-621-0508 (toll-free).

Reporting of identity theft and obtaining a police report

You have the right to obtain any police report filed in the United States in regard to this incident. If you are the victim of fraud or identity theft, you also have the right to file a police report.

For Iowa Residents: You are advised to report any suspected identity theft to law enforcement or to the Iowa Attorney General.

For Massachusetts Residents: You have the right to obtain a police report if you are a victim of identity theft. You also have a right to file a police report and obtain a copy of it.

For Oregon Residents: You are advised to report any suspected identity theft to law enforcement, the Federal Trade Commission, and the Oregon Attorney General.

For Rhode Island Residents: You have the right to file or obtain a police report regarding this incident.

Questions:   833-931-8488
Last Reviewed: Friday, October 16, 2026
Trending in Incident Notices
Recently Posted in Incident Notices