Cotchett, Pitre & McCarthy, LLP (“CPM”) filed a class action lawsuit in the U.S. District Court for the Northern District of California, against Educational Testing Service (“ETS”), on behalf of a proposed class of current and former K-12 California students who had their private information exposed as a result of ETS’ failure to implement adequate data security protections.
On October 16, 2026, ETS announced that hackers had breached its systems and obtained the private information of millions of California students and former students who attended a California public school within the past three years. ETS develops and administers standardized tests across the country. ETS’ products include, the California Assessment of Student Performance and Progress (CAASPP), the English Language Proficiency Assessments for California (ELPAC), the Test of English as Foreign Language (TOEFL), the Graduate Record Examination (GRE), and the ACT.
The data lost in the breach is wide-ranging. It includes names, birth dates, home addresses, grade levels, school information, statewide and local student ID numbers, demographic information about students, information on race, gender, ethnicity, primary language, country of origin, and English learner status and English language proficiency. The breach also includes (1) information obtained from the assessments themselves, (2) data related to a student’s eligibility to participate in programs for students with ties to the United States military and programs for impoverished, migrant, abandoned, or homeless youth, and (3) certain information on disabilities and medical conditions, including, but not limited to, data on individuals’ mental and physical disabilities, accommodation statuses, and status under Section 504 of U.S. Rehabilitation Act of 1973, which pertains in part to persons with certain physical and mental impairments.
The case alleges the breach was preventable and resulted from ETS’ failure to implement adequate and reasonable data security measures. The lawsuit is requesting damages, declaratory, and injunctive relief for students of a proposed class of those affected by this California student data breach.
Joe Cotchettsaid, “ETS needed the sensitive and private information of California’s young people to run its testing business. Instead of implementing adequate data security measures to protect their information, the company appears to have cut corners. ETS’ inadequate data security has now left approximately seven million California children and young adults exposed to fraud and identity theft. This is outrageous and completely unacceptable.”
Karin Swope said, “This data breach would never have happened if ETS had acted responsibly. According to the California Department of Education, this appears to have resulted from a hacker obtaining and exploiting a login credential to a website where ETS exchanged data with the California Department of Education. Simple, basic measures like authentication systems and controls on access would have prevented this breach. If ETS had used reasonable and adequate network monitoring, ETS would have quickly detected and been capable of containing any breach. Instead, hackers appear to have roamed the company’s systems for California students’ private and sensitive information for almost 5 months.”
Andrew Fuller said, “This data breach is particularly egregious because the young victims here are especially vulnerable. For children and young adults, it may be years before they open their first bank account or credit card and realize that criminals have exploited their data."
The California Department of Education has released a website on the data breach: https://www.cde.ca.gov/nr/in/ets-incident.asp.
About Cotchett, Pitre & McCarthy
Cotchett, Pitre & McCarthy, LLP engages exclusively in litigation and trials and has earned a national reputation for its dedication to prosecuting or defending socially just actions. CPM has been honored across the country for its work for the public, consumers and those without a voice in our courts.
