ETS Begins Notifying California Students and Families Following Data Security Incident

SACRAMENTO—Educational Testing Service (ETS), a nonprofit assessment organization under contract with the California Department of Education (CDE), has begun notifying California students and families about a data security incident involving unauthorized access to and copying of student information from an ETS-operated secure file transfer protocol (SFTP) site. CDE is distributing the ETS Notice of Data Breach to help ensure affected individuals receive information about the incident and available resources.

Following discovery of the incident, ETS has taken numerous measures to enhance the security of the SFTP site, including taking the SFTP site offline and building an entirely new SFTP site with enhanced security controls. ETS continues to evaluate additional security measures that may be appropriate. After working with law enforcement and cybersecurity experts, ETS has taken steps to reduce the potential risk of the data being made publicly accessible. Furthermore, ETS, following regular web monitoring, has, to date, not uncovered any evidence that the information has been made public.

After learning of the breach from ETS, CDE and the State Board of Education (SBE) immediately began coordinating with state cybersecurity partners and the vendor to assess the incident, identify affected information, and prepare notifications and resources for students and families. Notification distribution began October 16 and is expected to continue through early November.

The information involved varies by individual but may include student names, Statewide Student Identifier (SSID), dates of birth, addresses, demographic information, disability and program participation information, and statewide assessment information. Social Security numbers, financial account information, passwords, and parent or guardian information were not involved. ETS is providing affected current and former students with two years of identity-protection services through Experian IdentityWorks at no cost to them.

The ETS Notice of Data Breach is available online in 27 languages on the CDE website. The notice provides additional details about the incident, the information involved, and identity-protection services available to affected individuals.

For additional information and the latest updates about the incident, visit the CDE Educational Testing Service (ETS) Incident web page.

# # # #

Tony Thurmond — State Superintendent of Public Instruction
Communications Division, Room 5602, 916-319-0818, Fax 916-319-0100