California Student Data Breach, ETS Faces Putative Class Action Over Millions of School Records

A putative class action has been filed against Educational Testing Service (ETS) after unauthorized access to a California public school student data file-transfer site. The complaint, captioned 01 v. Educational Testing Service, No. 2:26-cv-12163, was filed on October 17, 2026, in the U.S. District Court for the Central District of California. No class has been certified, and there is no settlement and no claim form.

According to the California Department of Education (CDE), an unauthorized person used a compromised login credential to access an ETS-operated secure file transfer protocol (SFTP) site and copy student files at various times between May 22, 2026, and September 18, 2026. ETS identified the activity on September 25, 2026, and took the site offline.

News coverage has described the incident as affecting about 7 million students. The CDE has not published an exact total of affected people, so that figure is a media estimate and not an official count.

Affected current and former students can enroll in 24 months of free Experian IdentityWorks protection. The enrollment deadline is March 19, 2027. This offer is separate from the lawsuit and is not a cash payment.

Quick Facts: Educational Testing Service California Student Data Breach Lawsuit

Detail	Verified information
Company	Educational Testing Service (ETS), a nonprofit assessment organization under contract with the CDE
Court	U.S. District Court for the Central District of California
Case name	01 v. Educational Testing Service (plaintiff listed under a pseudonym)
Case number	2:26-cv-12163
Complaint filed	October 17, 2026
Period of unauthorized access	May 22, 2026 – September 18, 2026
Discovered by ETS	September 25, 2026
CDE vendor incident letter to districts	October 2, 2026
Notifications began	October 16, 2026 (expected through early November 2026)
Information involved	Names, dates of birth, addresses, student identifiers, demographic data, disability-related details, program eligibility, assessment data
Not involved, per CDE	Social Security numbers, driver’s license and passport numbers, financial account and card data, passwords, parent or guardian personal information
Litigation status	Newly filed putative class action; no class certification identified
Settlement or claim form	None
Free identity protection	24 months, Experian IdentityWorks, enroll by March 19, 2027
CDE helpline	833-931-8488

What Happened in the ETS California Student Data Breach?

ETS contracts with California to support statewide testing, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC). To do that work it exchanges student assessment data with the CDE through an SFTP site.

The state says an unauthorized person copied files from that site using a compromised credential. After discovery, ETS disabled the account, took the site offline and, according to the CDE, built an entirely new SFTP site with enhanced security controls.

The CDE and the State Board of Education (SBE) coordinated with state cybersecurity partners to assess the incident and prepare notices. They are also reviewing ETS’s compliance with applicable data security and contractual requirements.

As of the CDE’s October 16 update, ETS had not found evidence through its monitoring that the information had been made public. That is not proof that the data cannot be misused privately.

What Information Did the ETS Data Breach Expose?

The CDE says the copied files contained student demographic, program participation and assessment data. Depending on the person, that may include:

• Student names, dates of birth and residential addresses.
• School, school district and grade level.
• Statewide Student Identifier (SSID) and local student identifier.
• Gender, race or ethnicity, primary language, country of origin and English learner status.
• Disability and Section 504 status, testing accommodations and primary disability type.
• Eligibility for programs such as Title I, migrant education, McKinney-Vento and military-connected student programs.
• Statewide assessment registration, participation, English-language proficiency information and results.

Not every record contains every category.

Were Social Security Numbers or Bank Accounts Exposed in the ETS Breach?

No, according to the CDE. Social Security numbers, driver’s license and passport numbers, financial account information, credit and debit card data, passwords and parent or guardian personal information were not part of the copied files.

That does not make the exposure harmless. Names, birth dates, addresses, student ID numbers and disability or program details can make phishing messages far more convincing, and some of that information is highly sensitive when it concerns a child.

Who Is Affected by the California Student Data Breach at ETS?

The CDE says the affected group includes current and former California public school students enrolled between 2023 and the current school year, as well as some students who left a California school as far back as 2006 without a confirmed transfer. Adults who attended California schools may therefore be affected.

If you receive a notification letter or email, your or your student’s information was in the files that were accessed and copied. The CDE also warns that not receiving a notice does not necessarily mean a person was unaffected, particularly if contact details have changed.

Families with questions can call the CDE incident line at 833-931-8488, Monday through Friday, 6 a.m. to 6 p.m. Pacific Time. Callers should have engagement number B174774 (student under 18) or B174775 (affected person 18 or older). TTY is available through 711.

What Does the Putative Class Action Against ETS Allege?

The complaint alleges that ETS failed to use adequate safeguards to protect student information on its file-transfer system and allowed the compromise to continue for months without detection. Publicly reported details say it challenges access controls, multi-factor authentication, file-retention practices and monitoring for unusual downloads.

The reported claims are negligence, negligence per se, breach of fiduciary duty, unjust enrichment, invasion of privacy under the California Constitution and violation of California’s Unfair Competition Law, along with a request for declaratory and injunctive relief. The complaint reportedly seeks to represent a proposed nationwide class and a California subclass.

These are allegations only. ETS has not been found liable, and the court has not ruled on any claim. As of October 19, 2026, no class-certification order had been identified on the docket.

What Laws Apply to the ETS Student Data Breach?

Several federal and California laws may bear on this incident. Which ones actually apply to a nonprofit testing contractor depends on the facts, the contract with the CDE and the claims pleaded.

How Does California Negligence Law Apply to ETS?

Negligence requires a duty, a breach, causation and legally recognized harm. The plaintiff alleges ETS did not take reasonable steps to secure records it held for the State of California. Negligence per se can apply when a defendant violates a statute meant to protect a class of people, but the violated statute must be identified and the remaining elements still must be proven.

For timing, California’s general two-year limitations period for injury claims is in Code of Civil Procedure section 335.1. Section 352 can toll the period for minors until they turn 18. Whether either rule applies to a given person depends on the claim, so anyone weighing an individual claim should speak with a licensed California attorney.

Does California Civil Code Section 1798.81.5 Require ETS to Use Reasonable Security?

Civil Code section 1798.81.5 requires businesses that own, license or maintain certain personal information about California residents to use reasonable security procedures. Its definition of “personal information” is tied to specific data elements, such as Social Security numbers and account numbers, which the CDE says were not involved here. Whether it reaches student identifiers and demographic records is a legal question the court has not addressed.

Does the California Consumer Privacy Act (Civil Code Section 1798.150) Apply to ETS?

Section 1798.150 gives a private right of action, with statutory damages, for certain data breaches caused by a failure to maintain reasonable security. It is limited to the categories of personal information listed in the statute, and the CCPA’s definition of a covered “business” generally concerns for-profit entities. Because ETS is described by the CDE as a nonprofit, whether this statute reaches it is uncertain and has not been decided. The complaint, as publicly reported, does not list a CCPA claim.

What Does California Civil Code Section 1798.82 Require After a Breach?

Section 1798.82 sets breach-notification requirements for businesses that own or license computerized personal information of California residents, and for those that maintain it, including notice to the data owner. It also includes content requirements for notices and a requirement to notify the California Attorney General when more than 500 residents are affected. Whether and how it applies here turns on the same data-element and entity questions, and the CDE directed the notification process.

What Does California Education Code Section 49073.1 Say About Student Data Contracts?

Education Code section 49073.1 governs contracts between local educational agencies and third parties that receive pupil records. It requires specific provisions, including security and confidentiality terms and breach-notification procedures. The CDE says it is reviewing ETS’s compliance with data security and contractual requirements. That review is separate from the lawsuit, and no finding has been announced.

Does the Student Online Personal Information Protection Act (SOPIPA) Apply?

SOPIPA, Business and Professions Code section 22584, restricts operators of online services designed and used for K-12 school purposes from misusing student information and requires reasonable security. Whether an SFTP file-exchange system operated for statewide testing qualifies as a covered operator service has not been addressed publicly.

Does the Family Educational Rights and Privacy Act (FERPA) Provide Compensation?

FERPA, 20 U.S.C. section 1232g and 34 C.F.R. Part 99, restricts the disclosure of education records by funded educational agencies and institutions. It is enforced administratively by the U.S. Department of Education, and the U.S. Supreme Court held in Gonzaga University v. Doe, 536 U.S. 273 (2002), that FERPA does not create privately enforceable rights under 42 U.S.C. section 1983. A FERPA reference is therefore unlikely to give any student a direct right to money.

How Do Disability Records Laws Relate to the ETS Breach?

The copied files reportedly include Section 504 status and primary disability type. Section 504 of the Rehabilitation Act (29 U.S.C. section 794) and the Individuals with Disabilities Education Act, including its confidentiality rules at 20 U.S.C. section 1417(c) and 34 C.F.R. sections 300.610 to 300.627, address disability-related education records. These laws are relevant to why the data is sensitive. They do not by themselves establish that a private damages claim exists against a testing vendor.

How Do the California Constitution and the Unfair Competition Law Apply?

Article I, section 1 of the California Constitution protects privacy. A plaintiff generally must show a legally protected privacy interest, a reasonable expectation of privacy and a serious intrusion. The Unfair Competition Law, Business and Professions Code section 17200, covers unlawful, unfair or fraudulent business practices, and remedies are mostly limited to restitution and injunctive relief.

Can a Data Breach Plaintiff Show Standing in Federal Court?

Federal courts require a concrete injury. In TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), the Supreme Court held that class members must show concrete harm for each claim. Cases like this one are often contested on standing, on whether the exposed data creates a real risk of misuse, and on damages. The court will decide those issues as the case moves forward.

What Federal Rule Governs Class Certification Against ETS?

Federal Rule of Civil Procedure 23 requires a proposed class to meet numerosity, commonality, typicality and adequacy requirements, plus at least one category under Rule 23(b). Filing as a putative class action does not make a class certified. The Central District of California has not made that determination in this case.

How Can Students Enroll in Free Experian IdentityWorks After the ETS Breach?

ETS is providing 24 months of Experian IdentityWorks services at no cost to affected current and former students. The enrollment deadline is March 19, 2027. You need the activation code in your own notification letter or email. Enrollment does not require a credit card.

Students under 18: A parent or guardian enrolls the minor in Experian IdentityWorks Minor Plus at the Experian Minor Plus website. Minors who turn 18 before March 19, 2029, may enroll in the adult product using the adult activation code supplied with the notice.

Adults and former students: Enroll at the Experian IdentityWorks adult website.

The CDE also says identity-restoration assistance is available for 24 months from the date of notification for eligible people who experience identity theft, without needing to enroll in monitoring.

Use only the links on the CDE page. Do not trust unexpected emails, calls or texts claiming to be from ETS, the CDE or Experian.

What Should California Families Do After the ETS Student Data Breach?

1. Read your official notice and confirm what categories of information were involved.
2. Enroll in Experian IdentityWorks before March 19, 2027.
3. Watch for school-related phishing. Be wary of urgent messages about test results, disability records, school accounts or identity-protection memberships. Verify through contact details you find independently.
4. Consider a credit freeze. Under federal law (15 U.S.C. section 1681c-1), free security freezes are available to adults and, through a parent or guardian, to protected consumers under 16. A freeze is a precaution here because the CDE says Social Security numbers and financial data were not involved.
5. Review credit reports for free at AnnualCreditReport.com.
6. Keep records: notices, suspicious messages and any documented costs of protecting your information.

What Happens Next in the ETS Data Breach Lawsuit?

The next steps generally include service of the complaint, a response or motion to dismiss by ETS, possible related cases and a fight over class certification. Related lawsuits could be filed and consolidated. No settlement amount, claim deadline or class-certification hearing has been verified. It is too early to say whether students could ever receive money.

Is There an ETS Data Breach Settlement or Claim Form?

No. As of October 19, 2026, there is no settlement fund, court-approved class or claim form in 01 v. Educational Testing Service. If a settlement is reached later, eligibility and deadlines would come from a court-approved notice.

For comparison, other breach cases on this site involve different data and different allegations: Prosper Data Breach Lawsuit, 17.6 Million Records Exposed, What Customers And Applicants Need To Know, TransUnion Data Breach Exposes 4.4 Million Social Security Numbers, Two Class Action Lawsuits Filed and CareCloud Data Breach Lawsuit, Were You Affected? — Arslanian v. CareCloud Inc., No. 1:2026-cv-23048. Their allegations say nothing about liability or payment in the ETS matter.

Key Dates in the ETS California Student Data Breach

Date	Event
May 22, 2026	Unauthorized access to the ETS SFTP site begins, per the CDE
September 18, 2026	Reported unauthorized access ends
September 25, 2026	ETS identifies the unauthorized activity
October 2, 2026	CDE sends a vendor incident report to county and district officials
October 16, 2026	Notifications to students and families begin
October 17, 2026	01 v. Educational Testing Service, No. 2:26-cv-12163, is filed
Early November 2026	CDE expects notification distribution to continue through this period
March 19, 2027	Deadline to enroll in free Experian IdentityWorks
March 19, 2029	Cutoff relevant to minors who turn 18 and move to the adult product

Frequently Asked Questions About the ETS California Student Data Breach

How Many California Student Records Did the ETS Breach Expose?

Media reports say about 7 million, but the CDE has not published an exact total.

What Is the Case Number for the ETS Data Breach Lawsuit?

01 v. Educational Testing Service, No. 2:26-cv-12163, U.S. District Court for the Central District of California, filed October 17, 2026.

Has a Class Been Certified Against ETS?

No certification order was identified on the docket as of October 19, 2026. The case is a putative class action.

Were Social Security Numbers Stolen in the ETS Breach?

The CDE says no. Social Security numbers, driver’s license and passport numbers, financial data, passwords and parent or guardian information were not involved.

Can California Students Claim Money From ETS Right Now?

No. There is no settlement or claim form. The Experian offer is identity protection, not compensation.

What Is the Experian IdentityWorks Deadline for ETS Breach Victims?

March 19, 2027, for both minors and adults.

What Should I Do If I Did Not Receive an ETS Breach Notice?

Check the CDE incident page and call 833-931-8488. Not receiving a notice does not necessarily mean you were unaffected.

Does Federal Law Let Students Sue ETS Directly Under FERPA?

Generally no. FERPA does not create a private right to sue for damages, so any court claims must rest on other laws.

Sources and Court Records for the ETS Student Data Breach

1. CDE ETS Incident Information page: incident timeline, affected groups, data categories and support.
2. CDE news release, October 16, 2026: announcement that notifications began.
3. CDE Notice of Data Breach: official notice and enrollment instructions.
4. CDE vendor incident letter, October 2, 2026: initial report to district officials.
5. Federal docket, 01 v. Educational Testing Service, No. 2:26-cv-12163.
6. California Attorney General privacy resources.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the California Department of Education’s official ETS incident page, news release and Notice of Data Breach, and the federal court docket (CourtListener), as of October 19, 2026. Last Updated: October 19, 2026.

AllAboutLawyer.com provides general legal information, not legal advice. It is not a law firm and does not represent ETS, the California Department of Education or any party to this case.