The California Department of Education announced on Friday that Educational Testing Service (ETS), a company contracted by the state, experienced a data security breach that may have exposed personal information belonging to public school students statewide.
ETS is responsible for helping administer standardized tests for California public school students, including assessments in English language arts and mathematics. The incident involved an ETS-operated computer system, not local school district systems. However, because ETS handles assessment information for public schools throughout California, students in Orange County, including those in Irvine, may have been affected.
According to state officials, an unauthorized party gained access to ETS's system and copied files containing student information. These records date back to the 2023-24 school year.
The specific information accessed reportedly varies by student. ETS has confirmed that the compromised information did not include Social Security numbers, financial account information, passwords, or personal details about parents or guardians.
ETS identified suspicious activity on September 25. An investigation determined that an unauthorized party used compromised login credentials to access and copy student information between May 22 and September 18.
ETS stated that it has taken steps to strengthen security following the incident and has not found evidence that the copied information has been made publicly available.
Notifications to affected students and families began on October 16 and are expected to continue through early November. Current and former students who are affected are being offered two years of free identity-protection services through Experian IdentityWorks. These services are designed to help individuals monitor for potential misuse of personal information.
Details about these services, including enrollment instructions for minors and adults, are included in the official Notice of Data Breach. This notice is available through the California Department of Education and can be accessed in 27 languages. Families are encouraged to review the official notice and consider enrolling affected students in the provided services.
State officials also advise caution regarding unexpected emails, text messages, or phone calls that reference the incident, a student’s school, or statewide testing. Families should avoid sharing any personal, financial, or account information in response to unsolicited requests.
Additional resources and information are available to the public. The California Department of Education has established a dedicated information page that provides answers to frequently asked questions, official notifications, and updates regarding the investigation. The California Department of Justice’s privacy protection website also offers further resources. For specific questions about the incident or the available identity-protection services, families can call 833-931-8488, Monday through Friday, from 6 a.m. to 6 p.m. local time. The Orange County Department of Education is also sharing information about the incident directly with families served through its alternative education and special education programs.
