Current and former California public school students whose records were copied from an Educational Testing Service (ETS) file-transfer site in 2026 may be covered by a proposed class action alleging ETS failed to protect their names, birth dates, addresses, disability status and test results. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Educational Testing Service has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational. It is not legal advice.
What the ETS Lawsuit Is About
A proposed class action filed October 17, 2026 accuses Educational Testing Service, the nonprofit that runs California’s statewide student assessments, of failing to safeguard the records of the state’s public school students. The case, PL01 v. Educational Testing Service, No. 2:26-cv-12163, is pending in the U.S. District Court for the Central District of California in Los Angeles. The plaintiff, who was enrolled in a California public school, filed under a pseudonym.The suit follows a breach the California Department of Education (CDE) disclosed in October. According to CDE, someone used a compromised login credential to get into a secure file transfer protocol (SFTP) site that ETS ran for exchanging statewide assessment data with the department, and copied files from it at various times between May 22 and September 18, 2026. ETS identified the activity on September 25, 2026, disabled the account and took the site offline. The complaint says ETS did not notice the intrusion until a week after the last known download.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Who Is Affected
CDE says the copied files covered all students enrolled in California public schools in the three previous school years. Its incident page describes the affected group as current and former students enrolled between 2023 and the current school year, along with students who left a California school as far back as 2006 without confirming a transfer to another school. Many of those former students are now adults, and the complaint notes that some have moved out of California.The state has not published a total count. The complaint, citing Los Angeles Times reporting, says the breach reaches beyond the roughly 5.7 million students currently enrolled in California public schools.
ETS began sending notification letters and emails at CDE’s direction around October 16, 2026. CDE says that receiving a notice means a student’s information was in the copied files, but that not receiving one does not mean a student was unaffected, particularly when contact details have changed.
What Information Was Copied
According to CDE’s notice, the data varied by student but could include:- Name, date of birth, home address, school, district and grade level
- Statewide Student Identifier (a permanent 10-digit number assigned for a student’s time in California public schools) and local student ID
- Gender, race or ethnicity, primary language, country of origin and English-learner status
- Disability and Section 504 status, testing accommodations and primary disability type
- Eligibility for Title I, migrant education, McKinney-Vento homeless assistance and military-connected student programs
- English proficiency information and statewide assessment registration, participation and results
CDE says the files did not contain Social Security numbers, driver’s license or passport numbers, financial account or card information, or passwords, and that no parent or guardian information was involved. ETS has said it has not found evidence that the data has been posted publicly.
What ETS Is Accused Of
The complaint argues that a single stolen password should not have opened a months-long window into files about millions of students. It alleges, on information and belief, that ETS did not require multi-factor authentication for the SFTP site, did not limit access to known users, devices and network locations, did not delete files once they had been transferred, and lacked monitoring that would have flagged repeated downloads over nearly four months.The plaintiff also points to ETS’s own privacy statements, including its K-12 student data privacy statement saying it protects student data with appropriate security measures, including encryption, and keeps it only as long as needed. The complaint stresses that students had no choice about sharing this information, because California law requires schools to give the statewide tests, and it says the 24 months of identity protection ETS is offering falls short for children whose data may not be misused until they apply for credit or financial aid years from now.
ETS has not responded to the complaint in court. An ETS spokesperson told the Los Angeles Times, as quoted in the complaint, that the organization maintains a comprehensive information security program that is regularly assessed by third parties. CDE says ETS has since built a new SFTP site with stronger security controls, and that CDE and the State Board of Education are reviewing the incident and ETS’s compliance with data security and contract requirements.
The Proposed Classes and Legal Claims
The suit seeks to represent a nationwide class of U.S. residents whose personal information was in the files accessed and copied, including everyone ETS or CDE notified, along with a California subclass limited to state residents. It invokes the Class Action Fairness Act, alleging more than $5 million in controversy.It asserts seven counts:
- Negligence
- Negligence per se
- Breach of fiduciary duty
- Unjust enrichment
- Declaratory and injunctive relief
- Invasion of privacy under the California Constitution
- Violation of California’s Unfair Competition Law
The plaintiff asks for class certification, compensatory and consequential damages, restitution, and a court order requiring ETS to strengthen its data security, delete student data it no longer needs and provide longer identity-protection and credit-monitoring services, plus attorneys’ fees and a jury trial. The case was filed by Ahdoot & Wolfson, PC.
The Identity Protection Offer Is Separate From the Lawsuit
Independent of the case, ETS is providing 24 months of Experian IdentityWorks services at no cost to affected current and former students. Per CDE, parents or guardians enroll minors in the Minor Plus product and adults enroll in the adult product, the enrollment deadline for both is March 19, 2027, and the activation code arrives with the notification letter or email. Experian’s identity restoration assistance runs for 24 months from notification and does not require enrollment. Details are on the CDE’s ETS incident page.The breach is the latest in a run of incidents involving school data vendors, including the Frontline Education breach of school employees’ records and the Instructure Canvas student data breach.
What Happens Next
ETS has not yet appeared in the case, and the docket does not yet show a judge assignment. A breach affecting this many people typically draws more lawsuits, and when several are filed over the same incident they are commonly consolidated under one lead case, sometimes after a fight over which court should hear them. OpenClassActions.com will update this page as the case develops.Is There Anything to Claim?
No. There is no settlement, no settlement fund and no claim form. Any payment would come only if the case settles or the plaintiffs win at trial, which in data breach litigation usually takes a year or more. If a settlement is reached, class members would generally be identified from ETS and state records and sent notice.Questions
Is there an ETS data breach settlement?
No. As of October 18, 2026 the case is at the complaint stage. There is no settlement, no settlement fund and no claim form, and no class has been certified. The lawsuit was filed October 17, 2026.
Who is affected by the ETS data breach?
According to the California Department of Education, the affected group includes current and former students enrolled in California public schools between 2023 and the current school year, plus students who left a California school since 2006 without a confirmed transfer to another school. Many former students are now adults, and some no longer live in California.
Were Social Security numbers exposed in the ETS breach?
The California Department of Education says the copied files did not include Social Security numbers, driver’s license or passport numbers, financial account or card information, or passwords, and that parent and guardian information was not involved. The files did include names, dates of birth, home addresses, student ID numbers, demographic details, disability and program-eligibility status, and assessment results.
What identity protection is ETS offering?
ETS is providing 24 months of Experian IdentityWorks services at no cost to affected current and former students. The state says the enrollment deadline is March 19, 2027, and that the activation code comes with the notification letter or email. This offer is separate from the lawsuit.
Who would be in the proposed class?
The complaint proposes a nationwide class of U.S. residents whose information was in the files accessed and copied in the breach, including anyone ETS or the California Department of Education notified, plus a California subclass of state residents. A court has not certified either class.
Sources
- PL01 v. Educational Testing Service — docket, U.S. District Court for the Central District of California (CourtListener)
- Class Action Complaint, filed October 17, 2026 (CourtListener)
- Educational Testing Service (ETS) Incident — California Department of Education
- ETS Notification of Data Breach — California Department of Education
