Quick look: A data security breach involving a company contracted by the California Department of Education may have exposed personal information belonging to public school students across the state. Affected families are being notified, and free identity-protection services are available.
The California Department of Education announced on Friday that a company responsible for supporting statewide student assessments experienced a data security breach involving sensitive student information.
The incident involved Educational Testing Service (ETS), a company contracted by the state to help administer standardized tests for California public school students, including assessments in English language arts and mathematics.
According to state officials, an unauthorized party gained access to an ETS-operated computer system and copied files containing student information, including records dating back to the 2023-24 school year.
It’s important to note that the breach occurred within a system operated by the state’s testing contractor, not within local school district systems. However, because ETS handles assessment information for public schools throughout California, students across the state, including those in Orange County, may have been affected.
What information was involved?
The specific information that was accessed reportedly varies by student but may include:
- Student names, dates of birth, home addresses, schools and grade levels
- Demographic information, including race or ethnicity and primary language
- Disability status and accommodations provided during testing
- English learner status and participation in certain educational programs
- State assessment participation and test results
According to ETS, the compromised information did not include Social Security numbers, financial account information, passwords or personal information about parents or guardians.
ETS says it identified suspicious activity on Sept. 25. An investigation determined that an unauthorized party used compromised login credentials to access and copy student information between May 22 and Sept. 18.
The company also says it has taken steps to strengthen security and has not found evidence that the copied information has been made publicly available.
How will families be notified?
ETS began notifying affected students and families on Friday, Oct. 16, with notifications expected to continue through early November.
The company is offering affected current and former students two years of free identity-protection services through Experian IdentityWorks, which helps individuals monitor for potential misuse of personal information.
Details about the services, including enrollment instructions for minors and adults, are included in the official Notice of Data Breach, available through the California Department of Education.
The notice is available in 27 languages.
What can families do?
Families are encouraged to review the official notice and consider enrolling affected students in the free identity-protection services.
State officials also recommend being cautious of unexpected emails, text messages or phone calls referencing the incident, a student’s school or statewide testing. Families should always avoid sharing any personal, financial or account information in response to unsolicited requests.
Additional resources are available through the California Department of Justice’s privacy protection website.
Where can families learn more?
The California Department of Education has established a dedicated information page with answers to frequently asked questions, official notifications and updates about the investigation.
Families with questions about the incident or available identity-protection services can call 833-931-8488, Monday through Friday, from 6 a.m. to 6 p.m. local time.
OCDE is also sharing information about the incident with families directly served through its alternative education and special education programs.