ETS Notifies Ex-Pupils
The ETS breach reaches beyond today’s California pupils. CDE’s 16 October update confirms student-file copying through a compromised SFTP login between 22 May and 18 September, detected on 25 September 2026. Its 2 October letter had left scope unresolved.
Former students leaving since 2006 without a confirmed transfer are included. No letter does not mean unaffected.
What the notice means
Depending on the person, records may include identifiers, addresses, birthdates, school details, demographics, disability/accommodations, programme and assessment data. Excluded: Social Security, passport and driving-licence numbers; financial/card data; passwords; parents’ personal data.
ETS disabled the account and replaced the site. Monitoring has not found public posting, not proof against misuse.
Notifications run from 16 October into early November. Affected current/former students get 24 free Experian IdentityWorks months. Enrol by 19 March 2027; guardians enrol minors. No credit card is required. Start at the official CDE hub and verify unexpected messages.
Keep the next handoff clear
A useful family record need not become a second archive of sensitive documents. One suggested format is a short private log: the official page consulted, the action chosen, the date and the question still awaiting an answer. Keep activation details out of an ordinary shared task list. This is a proposed way to organise a response, not an additional requirement imposed by the state.
For a school helpdesk, consider a caller who wants help organising the next step. A workable process would record the question and direct the caller to the official support route, without asking them to send a complete breach letter to a general inbox. Separate “we supplied a verified contact route” from “this person’s case is resolved”. Those are different outcomes, and the second requires evidence from the responsible service.
No victim total, actor or credential origin is established publicly.
Primary evidence
- CDE incident FAQ, reviewed 16 October.
- CDE notification announcement, 16 October.
- CDE preliminary letter, 2 October.
