California Testing Contractor Faces Class Action After Student Data Breach
Educational Testing Service, which handles California’s statewide testing programs, faces a proposed class action over a breach involving records for about 7 million current and former public school students. The suit, filed Oct. 20, 2026, says stronger safeguards could have prevented the incident and seeks damages plus court-ordered security changes. California education officials say they are checking whether the company met its contractual and data-protection obligations.
ETS administers California’s CAASPP and ELPAC assessments, so its systems hold participation, educational, demographic, disability and program records. The alleged intrusion used a compromised credential on a file-transfer site; records were accessed and copied from May 22 to Sept. 18, 2026. ETS detected it Sept. 25 and told the state the next day.
The California Department of Education is reviewing whether ETS met contractual and data-security duties, working with state cybersecurity agencies and the State Board of Education. The suit, filed Oct. 20, seeks damages and mandated security changes; officials said exposed data did not include Social Security numbers, financial accounts, passwords or parent/guardian details.
The breach could affect millions of students and families whose school records may include disability, demographic and assessment details. Even without Social Security or financial data, exposed personal information may raise privacy and identity concerns, and it could weaken confidence in how testing contractors handle student data. State agencies and schools may face pressure to review vendor safeguards and communication practices, though the actual harm will depend on how the data is used and what protections follow.