The letter reaches a Sacramento mailbox in late October. It names a sixth grader, his home address, his school, his district, his grade level, and the fact that he gets extra time on state tests. His mother reads it twice. Ten days later an email arrives for her, naming that same school, asking her to finish enrolling her son in the free identity protection before his code expires. The link does not go to Experian. That second message is the part of the ETS data breach a family has to solve on its own.
Confirmation: confirmed by ETS and by the California Department of Education, which published the notice and began mailing students on 16 October 2026.
What happened in the ETS data breach
Educational Testing Service, better known as ETS, is the nonprofit that runs California’s statewide assessments under contract with the state. To move testing data between itself and the California Department of Education, it ran a secure file transfer site. That site is where this happened.
ETS says an unauthorized party used a compromised login credential to copy student files at various times between 22 May and 18 September 2026. So the door was open for roughly four months before anyone noticed it.
The dates after that are short and clear. ETS identified the unauthorized activity on 25 September. It disabled the account, took the file transfer site offline, and has since built a replacement with tighter controls. The Department of Education wrote to superintendents on 2 October, and ETS paused some enrollment data processing and testing while it checked its systems. Student notifications began on 16 October and will continue into early November.
Two things nobody has explained yet. No one has said how that credential was compromised, and no one has named who used it.
What the ETS data breach exposed
The notice says the information varies by student. Where it applies, it may include all of the following.
- Name, date of birth and residential address. This is the core identity set, and a child’s version of it has not been published anywhere before.
- School, district and grade level. This is what makes a fake message from “your child’s school” read as real.
- Statewide Student Identifier and local student identifier. The numbers that tie a record to a person across systems.
- Gender, race or ethnicity, primary language, country of origin and English learner status.
- Disability and Section 504 status, primary disability type, and testing accommodations.
- Program eligibility, including Title I Part A, Title I Part C, McKinney-Vento and military-connected designations.
- English language proficiency data and assessment registration, participation and results.
Read that list again, because it is not a commercial one. McKinney-Vento eligibility means a student experiencing homelessness. Title I Part C covers the children of migratory workers. Country of origin, primary disability type, and a child’s test results are facts a family would not choose to publish. In short, this breach exposed a child’s school life rather than a shopping history.
What was not taken
The notice is specific about the limits, and they matter. It says the data did not include Social Security numbers, driver’s license or passport numbers, financial account or payment card details, or account passwords. Parent and guardian information was not involved either. The published field list also does not include email addresses.
ETS also says its web monitoring has not found evidence that the information has been made public. That is a monitoring result, not a guarantee, so treat it as the current state of the investigation rather than the end of it.
How many students does the ETS data breach affect?
Neither ETS nor the state has published a count. The notice instead describes who is covered: all students enrolled in the three previous school years, plus former students going back to 2006 whose transfers were not confirmed with the department.
For scale, more than 5.7 million students were enrolled in California public schools in 2025–26. That is a ceiling on the current cohort, not a number of affected people. Until the state or ETS publishes a figure, any number circulating this week is somebody’s estimate.
The free identity protection, and the date to watch
ETS is offering 24 months of Experian IdentityWorks at no cost, with no credit card required. The activation codes differ by age.
- Students under 18: enroll at
experianidworks.com/minorpluswith codeRSWMV3F3N, by 19 March 2027. - Students 18 and over: enroll at
experianidworks.com/identitywith codeN8MDNZPJD.
One wrinkle worth knowing. The notice gives the adult enrollment deadline as 19 March 2027 in its summary and 19 March 2029 in the detail section, so enroll well before the earlier date and do not rely on the later one. Identity restoration support runs for 24 months from the date of your letter and does not require enrolling. Experian’s line for this incident is 833-931-8488, Monday to Friday, 6:00 a.m. to 6:00 p.m. Pacific.
One more step the notice does not emphasise. A parent can freeze a minor’s credit file at all three bureaus for free, and because a child has no legitimate reason to hold credit, a freeze blocks the main use of a stolen child identity.
What to do now
Most of this has nothing to do with us.
- Enroll the student, using the code printed on your own letter rather than one from a message that found you.
- Freeze your child’s credit at Equifax, Experian and TransUnion. It is free, and for a minor there is no cost to leaving it frozen for years.
- Treat any breach message as a notification, not an instruction. Then go to
cde.ca.gov/etsby typing it yourself and check what it says. - Expect the school-shaped version. A convincing fake can now name the district, the school and the grade, because those were in the data.
- Be careful with identity questions by phone. A caller who already knows a child’s name, birthday and address can sound official while asking for what they are missing.
- Use a password manager, so one password does not sit on a dozen other sites.
- Turn on the strongest sign-in each of your accounts offers, which usually means a passkey or an authenticator app ahead of text message codes.
- Check the sender’s full address, not the display name. The right name in front of a wrong domain is the oldest move there is.
How OptMsg changes this exposure
We want to be careful here. The ETS data breach happened inside another organization’s file transfer site, and nothing on our side would have changed what left it. Email addresses were not even in the published field list.
What changes is the next step, in your inbox. Mail from a sender you have not approved goes to Trash rather than your Inbox, and auto-deletes after 30 days. So the “finish your student’s enrollment before the code expires” message from a sender you have not approved lands in Trash instead of sitting next to the real notice from the district.
Your OptMsg account also has no password, so a password stolen from another site can’t open your inbox. Because your email is how most accounts get reset, keeping that door shut keeps the rest shut with it. Our security first page explains how the approved-sender part works.
Here is what the argument does not cover, stated plainly. It does nothing about a compromised device, a live phishing page you type your details into, or somebody holding your unlocked phone. The claim is narrow on purpose, because a password that does not exist cannot be stolen or reused.
Want an inbox where a breach at a testing vendor does not turn into a month of suspicious email? Create your OptMsg account and pick your address while the good ones are still free.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Q: What was exposed in the ETS data breach? A: The notice lists student name, date of birth, residential address, school, district and grade level, state and local student identifiers, gender, race or ethnicity, primary language, country of origin and English learner status. For some students it also includes disability and Section 504 status, primary disability type, testing accommodations, program eligibility such as Title I or McKinney-Vento, and assessment registration and results.
Q: Were Social Security numbers or passwords taken? A: The notice says no. It states the data did not include Social Security numbers, driver’s license or passport numbers, financial account or card details, or account passwords, and that parent or guardian information was not involved.
Q: How many California students does the ETS data breach affect? A: No count has been published. The notice covers all students enrolled in the three previous school years, plus former students back to 2006 whose transfers were not confirmed with the state.
Q: How do I get the free identity protection? A: ETS is offering 24 months of Experian IdentityWorks at no cost. Parents of students under 18 enroll at experianidworks.com/minorplus with code RSWMV3F3N by 19 March 2027, and students 18 and over enroll at experianidworks.com/identity with code N8MDNZPJD. Use the code on your own letter and call 833-931-8488 if it does not work.
Q: How do I tell a real notification from a fake one? A: Often you cannot from the inbox alone, and that is the problem. Read any such message as a prompt to check for yourself, then reach the state by typing cde.ca.gov/ets into your browser.
Sources
- California Department of Education, “ETS Data Security Incident” notice to affected students, last reviewed 19 October 2026 — https://www.cde.ca.gov/nr/in/ets-notification.asp
- California Department of Education, ETS incident information page — https://www.cde.ca.gov/ets
- SecurityWeek, “One Compromised Login Exposed Millions of California Students’ Records”, 19 October 2026 — https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/
Previous in Breach Breakdown: The More Rewards Breach Handed Out the Answers to Your Security Questions
Next in Breach Breakdown: The Nikkei Data Breach Is the Third One in a Month
