Published
October 18, 2026
Updated
November 5, 2026
Current and former California public school students whose records were copied from an Educational Testing Service (ETS) file-transfer site in 2026 may be covered by three proposed class actions, filed October 17, October 20 and November 3, 2026, alleging ETS failed to protect their names, birth dates, addresses, disability status and test results. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Educational Testing Service has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational. It is not legal advice.
What the ETS Lawsuit Is About
A proposed class action filed October 17, 2026 accuses Educational Testing Service, the nonprofit that runs California’s statewide student assessments, of failing to safeguard the records of the state’s public school students. The case, PL01 v. Educational Testing Service, No. 2:26-cv-12163, is pending in the U.S. District Court for the Central District of California in Los Angeles. The plaintiff, who was enrolled in a California public school, filed under a pseudonym.The suit follows a breach the California Department of Education (CDE) disclosed in October. According to CDE, someone used a compromised login credential to get into a secure file transfer protocol (SFTP) site that ETS ran for exchanging statewide assessment data with the department, and copied files from it at various times between May 22 and September 18, 2026. ETS identified the activity on September 25, 2026, disabled the account and took the site offline. The complaint says ETS did not notice the intrusion until a week after the last known download.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Status
Three Lawsuits Filed
October 17 (C.D. Cal.) and October 20, 2026 (N.D. Cal.) · No class certified
Breach Window
May 22 – September 18, 2026
Files copied from an ETS-operated SFTP site, per the state
Data at Issue
Student identity, disability and test data
No Social Security numbers or financial data, per the state
Can I Claim?
No — nothing to claim yet
Who Is Affected
CDE says the copied files covered all students enrolled in California public schools in the three previous school years. Its incident page describes the affected group as current and former students enrolled between 2023 and the current school year, along with students who left a California school as far back as 2006 without confirming a transfer to another school. Many of those former students are now adults, and the complaint notes that some have moved out of California.The state has not published a total count. The complaint, citing Los Angeles Times reporting, says the breach reaches beyond the roughly 5.7 million students currently enrolled in California public schools.
ETS began sending notification letters and emails at CDE’s direction around October 16, 2026. CDE says that receiving a notice means a student’s information was in the copied files, but that not receiving one does not mean a student was unaffected, particularly when contact details have changed.
What Information Was Copied
According to CDE’s notice, the data varied by student but could include:- Name, date of birth, home address, school, district and grade level
- Statewide Student Identifier (a permanent 10-digit number assigned for a student’s time in California public schools) and local student ID
- Gender, race or ethnicity, primary language, country of origin and English-learner status
- Disability and Section 504 status, testing accommodations and primary disability type
- Eligibility for Title I, migrant education, McKinney-Vento homeless assistance and military-connected student programs
- English proficiency information and statewide assessment registration, participation and results
CDE says the files did not contain Social Security numbers, driver’s license or passport numbers, financial account or card information, or passwords, and that no parent or guardian information was involved. ETS has said it has not found evidence that the data has been posted publicly.
What ETS Is Accused Of
The complaint argues that a single stolen password should not have opened a months-long window into files about millions of students. It alleges, on information and belief, that ETS did not require multi-factor authentication for the SFTP site, did not limit access to known users, devices and network locations, did not delete files once they had been transferred, and lacked monitoring that would have flagged repeated downloads over nearly four months.The plaintiff also points to ETS’s own privacy statements, including its K-12 student data privacy statement saying it protects student data with appropriate security measures, including encryption, and keeps it only as long as needed. The complaint stresses that students had no choice about sharing this information, because California law requires schools to give the statewide tests, and it says the 24 months of identity protection ETS is offering falls short for children whose data may not be misused until they apply for credit or financial aid years from now.
ETS has not responded to the complaint in court. An ETS spokesperson told the Los Angeles Times, as quoted in the complaint, that the organization maintains a comprehensive information security program that is regularly assessed by third parties. CDE says ETS has since built a new SFTP site with stronger security controls, and that CDE and the State Board of Education are reviewing the incident and ETS’s compliance with data security and contract requirements.
The Proposed Classes and Legal Claims
The first suit seeks to represent a nationwide class of U.S. residents whose personal information was in the files accessed and copied, including everyone ETS or CDE notified, along with a California subclass limited to state residents. It invokes the Class Action Fairness Act, alleging more than $5 million in controversy.It asserts seven counts:
- Negligence
- Negligence per se
- Breach of fiduciary duty
- Unjust enrichment
- Declaratory and injunctive relief
- Invasion of privacy under the California Constitution
- Violation of California’s Unfair Competition Law
The plaintiff asks for class certification, compensatory and consequential damages, restitution, and a court order requiring ETS to strengthen its data security, delete student data it no longer needs and provide longer identity-protection and credit-monitoring services, plus attorneys’ fees and a jury trial. The case was filed by Ahdoot & Wolfson, PC.
A Second Lawsuit, Filed on Behalf of Minor Students
A second proposed class action followed on October 20, 2026 in the U.S. District Court for the Northern District of California: K. v. Educational Testing Service, No. 1:26-cv-12217. Two minor students enrolled in public schools in Humboldt County, California, sue through their parent, and an adult co-plaintiff joins them. Citing public reporting, the complaint estimates that roughly 7 million people were affected.This complaint puts more weight on health-related records. It alleges that ETS collects and stores documentation from students’ medical and disability assessments when it decides testing accommodations, covering conditions such as ADHD, autism, learning disabilities and chronic health conditions, and it describes the exposed data as both personally identifiable information and protected health information. The California Department of Education’s description of the copied files, set out below, does not use the term protected health information.
It proposes a nationwide class of all natural persons whose personal or protected health information was compromised in the breach, plus a California subclass. It pleads eight counts: negligence, breach of third-party beneficiary agreements, breach of implied contracts, breach of fiduciary duty, unjust enrichment, violation of California’s Unfair Competition Law, invasion of privacy under the California Constitution, and declaratory judgment. The plaintiffs seek damages, restitution, injunctive and declaratory relief requiring stronger data security, attorneys’ fees and a jury trial. The case was filed by Cotchett, Pitre & McCarthy, LLP. These are allegations; ETS has not responded in court.
A Third Lawsuit, Filed in San Diego
A third proposed class action was filed November 3, 2026 in the U.S. District Court for the Southern District of California: J.M.A. v. Educational Testing Service, No. 3:26-cv-06275. A San Diego parent sues on behalf of her three minor children, who attend schools in the San Diego Unified School District. The complaint says she learned of the breach on or about October 19, 2026 through an email from the school district, and that she has not received a notice from ETS itself.Relying on the California Department of Education’s incident page, the complaint says the affected students include current and former students enrolled in California public schools since 2023, as well as students who left a California school since 2006 without a confirmed transfer, so many affected people are now adults and some no longer live in California. It argues that ETS’s offer of 24 months of identity protection is too short because much of the copied information, such as birth dates, disability information and country of origin, cannot be changed, and because children may not discover identity theft until they first apply for credit, jobs, financial aid or housing.
It proposes a nationwide class and a California subclass and pleads seven counts: negligence, breach of implied contract, declaratory and injunctive relief, invasion of privacy under the California Constitution, the California Customer Records Act, the California Consumer Privacy Act and California’s Unfair Competition Law. Under the Consumer Privacy Act claim, the plaintiff seeks actual damages and an injunction for now and says she may add a request for statutory damages after giving ETS the required written notice. The case was filed by Jennifer M. French, APC and AWKO Law LLP. These are allegations; ETS has not responded in court.
The Identity Protection Offer Is Separate From the Lawsuit
Independent of the case, ETS is providing 24 months of Experian IdentityWorks services at no cost to affected current and former students. Per CDE, parents or guardians enroll minors in the Minor Plus product and adults enroll in the adult product, the enrollment deadline for both is March 19, 2027, and the activation code arrives with the notification letter or email. Experian’s identity restoration assistance runs for 24 months from notification and does not require enrollment. Details are on the CDE’s ETS incident page.The breach is the latest in a run of incidents involving school data vendors, including the Frontline Education breach of school employees’ records and the Instructure Canvas student data breach.
What Happens Next
ETS has not yet appeared in any of the cases. With suits now pending in three different federal districts in California, the Central, Northern and Southern Districts, the cases may be related, transferred or consolidated under one lead case, and more suits may follow; which court ends up hearing them has not been decided. OpenClassActions.com will update this page as the case develops.Is There Anything to Claim?
No. There is no settlement, no settlement fund and no claim form. Any payment would come only if the case settles or the plaintiffs win at trial, which in data breach litigation usually takes a year or more. If a settlement is reached, class members would generally be identified from ETS and state records and sent notice.Questions
Is there an ETS data breach settlement?
No. As of November 5, 2026 all three lawsuits are at the complaint stage. There is no settlement, no settlement fund and no claim form, and no class has been certified. The first lawsuit was filed October 17, 2026 in Los Angeles federal court, a second on October 20, 2026 in federal court in Northern California and a third on November 3, 2026 in federal court in San Diego.
Who is affected by the ETS data breach?
According to the California Department of Education, the affected group includes current and former students enrolled in California public schools between 2023 and the current school year, plus students who left a California school since 2006 without a confirmed transfer to another school. Many former students are now adults, and some no longer live in California.
Were Social Security numbers exposed in the ETS breach?
The California Department of Education says the copied files did not include Social Security numbers, driver’s license or passport numbers, financial account or card information, or passwords, and that parent and guardian information was not involved. The files did include names, dates of birth, home addresses, student ID numbers, demographic details, disability and program-eligibility status, and assessment results.
What identity protection is ETS offering?
ETS is providing 24 months of Experian IdentityWorks services at no cost to affected current and former students. The state says the enrollment deadline is March 19, 2027, and that the activation code comes with the notification letter or email. This offer is separate from the lawsuit.
Who would be in the proposed class?
All three complaints propose a nationwide class of people whose information was compromised in the breach and a California subclass. The first defines the nationwide class as U.S. residents whose information was in the files accessed and copied, including anyone ETS or the California Department of Education notified; the second defines it as all natural persons whose personal or protected health information was compromised; the third defines it as all persons in the United States whose information was accessed and disclosed in the breach. A court has not certified any class.
Sources
- PL01 v. Educational Testing Service — docket, U.S. District Court for the Central District of California (CourtListener)
- Class Action Complaint, filed October 17, 2026 (CourtListener)
- K. v. Educational Testing Service — docket, U.S. District Court for the Northern District of California (CourtListener)
- Class Action Complaint, No. 1:26-cv-12217, filed October 20, 2026 (PDF via CourtListener)
- J.M.A. v. Educational Testing Service — docket, U.S. District Court for the Southern District of California (CourtListener)
- Educational Testing Service (ETS) Incident — California Department of Education
- ETS Notification of Data Breach — California Department of Education
For more class actions keep scrolling below.
Status
Three Complaints Filed
Case Titles
PL01 v. Educational Testing Service · K. v. Educational Testing Service · J.M.A. v. Educational Testing Service
Case Numbers
2:26-cv-12163 (C.D. Cal.) · 1:26-cv-12217 (N.D. Cal.) · 3:26-cv-06275 (S.D. Cal.)
Courts
U.S. District Courts, Central, Northern and Southern Districts of California
Date Filed
October 17, October 20 and November 3, 2026
Court Docket
CourtListener Docket
