If your child took California's CAASPP or ELPAC tests in the last three school years, assume their record was copied in the ETS breach. Enroll them in the free two-year Experian IdentityWorks coverage before March 19, 2027, freeze their credit and watch for school-themed phishing. No Social Security numbers were taken, but names, birth dates and home addresses were.
What Happened in the ETS Breach
Educational Testing Service (ETS) runs California's statewide student assessments under contract with the California Department of Education (CDE). According to the CDE's official notice, an unauthorized party used a compromised login credential to access an SFTP file-transfer site that ETS used to exchange assessment data with the state. The access happened at various times between May 22 and September 18, 2026. ETS identified the activity on September 25, disabled the account, took the site offline and rebuilt it with stronger controls.
The CDE says the copied files cover students enrolled in the three previous school years, current and former. That is more than 5.7 million students enrolled in 2025-26 alone, and roughly 7 million once recent former students are counted, one of the largest student data exposures since the PowerSchool breach. The CDE says ETS has not found that any of the information has been made public.
What Data Was Exposed
The data varies by student, but the CDE notice lists:
- Identity data: name, date of birth, residential address, school, district and grade level
- Student identifiers: Statewide Student Identifier (SSID) and local student ID
- Demographics: gender, race or ethnicity, primary language, country of origin and English learner status
- Sensitive education records: disability and Section 504 status, testing accommodations and primary disability type
- Program eligibility: Title I, migrant education (Title I, Part C), McKinney-Vento homeless status and military-connected student status
- Test data: English proficiency information and statewide assessment registration, participation and results
What Was Not Taken
The notice states that Social Security numbers, driver's license and passport numbers, financial account information, card numbers and passwords were not included. Parent and guardian personal information was not involved either.
Without SSNs, criminals cannot directly open credit in your child's name. But a name, birth date and home address is the core of a synthetic identity, and the disability, homelessness and immigration-related fields make this data unusually sensitive for targeted scams and harassment.
Step 1: Confirm the Notice Is Real
Scammers send fake breach letters within days of a big announcement. Check any letter or email against the official CDE page at cde.ca.gov/ets, and only call the ETS call center at 833-931-8488 (Monday to Friday, 6 a.m. to 6 p.m. Pacific; TTY 711). The CDE warns that fake identity protection sites may appear, so type URLs yourself rather than clicking links.
Step 2: Enroll in Free Experian IdentityWorks
ETS is paying for 24 months of Experian IdentityWorks, with no credit card required. The CDE has published the enrollment details:
- Students under 18: enroll at experianidworks.com/minorplus with activation code RSWMV3F3N (engagement number B174774). Deadline: March 19, 2027.
- Students 18 and older: enroll at experianidworks.com/identity with activation code N8MDNZPJD (engagement number B174775).
The CDE notice gives conflicting adult deadlines (March 19, 2027 in one place, 2029 in another), so enroll now rather than waiting. Minors who turn 18 before March 19, 2029 can switch to the adult code after their birthday. Free post-breach monitoring is useful, but it only alerts you after something happens; see whether free breach monitoring is enough for what it does and doesn't cover.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 3: Freeze Your Child's Credit
A credit freeze is free and the strongest protection a minor has. Most children have no credit file, and a parent can ask Equifax, Experian and TransUnion to create one and freeze it immediately. Then nobody, including a fraudster with your child's name and birth date, can open credit in their name until you lift it. Our guide to freezing a child's credit walks through the documents each bureau asks for. Students 18 and over can freeze their own credit online in about 15 minutes.
Step 4: Watch for School-Themed Phishing
The stolen files tie each student to a school, district, grade and test history, which is ideal raw material for convincing scams. Expect messages that:
- Claim to be from your district or ETS and ask you to "verify" your child's details
- Offer a settlement, refund or upgraded protection for a fee
- Reference special education services or accommodations to seem legitimate
- Target students directly on social media, using their school and grade
Never share passwords, SSNs or payment details in response to an unsolicited message. Review how to spot phishing with your teen, since students 13 and up are now direct targets.
Your Home Address Is Now in Two Places
Data brokers already publish most families' home addresses and phone numbers. Combined with a leaked student record, a scammer can match a child's name, school and disability status to a parent's phone number in minutes. Removing your household from people-search sites breaks that link.
Step 5: Remove Your Family From Data Broker Sites
The ETS data includes residential addresses, and people-search sites like Spokeo, Whitepages and BeenVerified sell the rest: parents' names, phone numbers, relatives and email addresses. Removing those listings makes it much harder to turn a leaked student record into a phone call or a knock at the door.
PrivacyOn removes your household from 100+ data broker and people-search sites, monitors 24/7 for re-listings, includes dark web monitoring and covers up to 5 family members from $8.33/month. Compare options in our roundup of the best data removal services, or start with a free PrivacyOn scan to see where your family is exposed today.
Step 6: Keep Records and Watch for Updates
Save the notice letter, note the date you enrolled in IdentityWorks and keep the CDE page bookmarked. If you later find misuse, such as an account, benefit claim or tax return in your child's name, report it at identitytheft.gov and follow our steps for when a child's identity is stolen. California residents can also review guidance from the state Department of Justice at oag.ca.gov/privacy.
Frequently Asked Questions
Was my child affected by the ETS data breach?
If your child was enrolled in a California public school in any of the three previous school years, they are likely affected, whether or not they still attend. The CDE says the affected group includes these students "but is not limited to" them. Notices are going to families, but you do not need to wait for a letter to enroll in free monitoring.
Were Social Security numbers stolen in the ETS breach?
No. The CDE's notice says SSNs, driver's license and passport numbers, financial accounts, card numbers and passwords were not in the copied files. Names, birth dates, home addresses, student IDs, demographics, disability status and test results were.
How do I sign up for the free ETS credit monitoring?
Go to experianidworks.com/minorplus for students under 18 (code RSWMV3F3N) or experianidworks.com/identity for students 18 and older (code N8MDNZPJD). Coverage lasts 24 months and requires no credit card. Call 833-931-8488 with the engagement number if the code doesn't work.
Do I need to freeze my child's credit after the ETS breach?
It is strongly recommended. Even without an SSN, a name, birth date and address can be combined with other leaked data to build a synthetic identity. A freeze at all three bureaus is free and blocks new credit until you lift it.
Can I sue ETS over the data breach?
Breaches this size often lead to class action lawsuits, but any case would take months or years to resolve and doesn't replace the protective steps above. Keep your notice letter and enrollment records in case a settlement is announced later.
What is the best way to protect my family after a student data breach?
Combine the free Experian coverage and a credit freeze with removing your household from data broker sites. PrivacyOn handles that removal across 100+ sites for up to 5 family members, with 24/7 monitoring and dark web alerts, so leaked school data is harder to link to your phone, email and address.