ETS California student data breach lawsuit (CAASPP and ELPAC testing records)

Educational Testing Service, the nonprofit that runs California's statewide student tests under a state contract, faces at least four proposed class actions over a data breach involving student testing records. The California Department of Education says an unauthorized party used a stolen login to copy student files from an ETS file-transfer site between May 22 and September 18, 2026.

The suits were filed in four federal courts in California between October 17 and 21, 2026. They say ETS failed to protect information about children and former students. No court has ruled, no class has been certified and there is no settlement. ETS is separately offering free identity protection, with enrollment due by March 19, 2027.

ETS is a New York nonprofit based in Princeton, New Jersey, according to the Northern District complaint. It administers the California Assessment of Student Performance and Progress, called CAASPP, and the English Language Proficiency Assessments for California, called ELPAC. The state says ETS keeps student demographic, program and test data to run those programs.

The plaintiffs include two Humboldt County children suing through their mother, Tiana Chamberlain, and Adam Simson, a 2026 graduate of a Hamilton City high school, represented by Cotchett, Pitre and McCarthy in the Northern District. A plaintiff using the pseudonym PL01 sued in the Central District through Ahdoot and Wolfson. A Bakersfield-area student, R.C., sued through guardian Wendy Cross in the Eastern District, represented by Wise Law Firm and Israel David LLC. A fourth case, S.R. v. Educational Testing Service, was filed in the Southern District on October 21.

According to the state's notice, ETS identified unauthorized activity on September 25, 2026, on a secure file transfer protocol site used to exchange statewide testing information with the department. ETS disabled the account, took the site offline and brought in outside cybersecurity experts. The investigation found that someone used a compromised credential at various times from May 22 to September 18, 2026, to access the site and copy files.

The state says the copied files varied by student but may include:

• Name, date of birth, home address, school, district and grade level.
• Statewide Student Identifier and local student ID.
• Gender, race or ethnicity, primary language, country of origin and English learner status.
• Disability and Section 504 status, testing accommodations and primary disability type.
• Eligibility for Title I, migrant education, McKinney-Vento homeless services and military-connected student programs.
• English proficiency information and state test registration, participation and results.

The state says the files did not include Social Security, driver's license or passport numbers, financial account or card information, or passwords. Parent and guardian information was not involved.

The Northern District complaint says ETS promised in its K-12 Student Data Privacy Statement that it "protects K-12 Student Data at all times using appropriate security measures, including encryption" and does not keep student data "longer than needed." The plaintiffs say ETS broke those promises, in part because records of students who had already graduated were on the site. They bring eight claims, including negligence, breach of implied contract, breach of fiduciary duty, unjust enrichment, California's Unfair Competition Law and invasion of privacy.

The Central District complaint brings seven claims, including negligence per se and invasion of privacy under the California Constitution. The Eastern District complaint brings negligence, breach of implied contract, unjust enrichment and declaratory judgment claims. These are allegations.

ETS's position appears in the notice it sent at the state's direction. It says it built an entirely new file-transfer site with stronger security, has worked with law enforcement to reduce the risk that the data becomes public and has found no evidence through web monitoring that it has been published. We found no court filing or statement from ETS responding to the lawsuits.

No judge has ruled on anything in these cases. The Northern District case is assigned to Magistrate Judge Robert M. Illman. The Eastern District case is assigned to Judge Kirk E. Sherriff and Magistrate Judge Christopher D. Baker. The Southern District case is assigned to Judge Anthony J. Battaglia. The public docket we checked showed no judge for the Central District case.

Several cases cover the same breach and may later be combined. Nothing on the dockets shows that yet.

The state says affected people include current and former students enrolled in California public schools from 2023 through the current school year, plus students who left a California school since 2006 without a confirmed transfer. A notice from ETS or the state means your record was in the copied files.

The proposed classes differ by complaint:

• Northern District: all people whose information was compromised in the breach, plus a California subclass.
• Central District: U.S. residents as of the filing date whose information was in the copied files, including anyone who received a notice, plus a California subclass.
• Eastern District: all people whose information was compromised in the breach.

These definitions are proposals and could change.

1. Enroll in the free Experian service by March 19, 2027. Parents use Minor Plus at experianidworks.com/minorplus for students under 18. Adults use experianidworks.com/identity. Your activation code is in your notice.
2. If you did not get a notice or lost it, call 833-931-8488, Monday through Friday, 6 a.m. to 6 p.m. Pacific Time.
3. Adults can get free credit reports at annualcreditreport.com and freeze their credit. Parents can ask the credit bureaus for a freeze for a child under 16.
4. Be wary of messages that mention your school, state testing or this incident. Enrollment never requires a credit card.
5. Keep your notice and records of any fraud.

There is no lawsuit payment now. The complaints ask for actual, statutory or nominal damages, restitution, credit monitoring and orders requiring better security and deletion of old student data. Any money would come only from a court judgment or a settlement, and amounts would depend on what the court approves.

The Experian service, with 24 months of monitoring and identity restoration help, is available now regardless of the lawsuits. Minors who turn 18 before March 19, 2029 can switch to the adult product with the adult code in their notice.

• May 22 to September 18, 2026: Period of unauthorized access, per the state.
• September 25, 2026: ETS identified the activity.
• October 17, 2026: Central District complaint filed.
• October 20, 2026: Northern and Eastern District complaints filed.
• October 21, 2026: Southern District complaint filed.
• March 19, 2027: Experian enrollment deadline.

There are no claim, opt-out or objection deadlines in the lawsuits yet.

• SFTP site: A secure server used to send and receive files between organizations.
• Statewide Student Identifier: A random 10-digit number California assigns to each public school student.
• Section 504: A federal law that requires schools to accommodate students with disabilities.
• Negligence per se: A claim that breaking a safety law or regulation is itself proof of carelessness.
• Consolidation: Combining related cases before one judge.

ETS will answer or move to dismiss each complaint after service. The cases may be combined, and more suits could follow. The state says it and the State Board of Education are reviewing ETS's compliance with data security and contract requirements.

This article relies on the state's incident FAQ and notice of data breach, and the complaints in the Northern District, Central District and Eastern District. The Southern District complaint was not publicly available to us, so its claims are not described.

The state has not published a total count of affected people on its incident pages, so we do not give one. Claims that ETS was careless are allegations. Judge assignments come from a public docket archive that may lag the court.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.