What Happened in the California Department of Education Data Breach?
In October 2026, the California Department of Education (CDE) issued formal notifications regarding a serious data security incident involving an external vendor: the Educational Testing Service (ETS). ETS is the primary testing contractor responsible for administering California's mandatory standardized state assessments, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).
According to official security disclosures, an unauthorized entity used compromised credentials to gain access to an ETS secure file transfer protocol (SFTP) server between May 22, 2026, and September 18, 2026. ETS identified the unauthorized access on September 25, 2026, and terminated the affected server. However, during the months the system was breached, extensive student files were copied.
While local school district networks (such as servers in Palm Springs Unified, Desert Sands Unified, and Coachella Valley Unified) were not directly penetrated, the central repository holding statewide testing data was compromised.
Why This Breach Is Catastrophic for Special Education and 504 Students
For general education students, the data exposed includes names, addresses, grade levels, student identification numbers, and test scores. However, for children receiving accommodations under the Individuals with Disabilities Education Act (IDEA) or Section 504 of the Rehabilitation Act, the exposure is far more invasive.
To administer standardized tests with legal fidelity, ETS maintains detailed operational files documenting every student's approved testing conditions. The exposed files contain:
- Disability Classifications: Whether a student is identified with Autism, Specific Learning Disability (Dyslexia, Dyscalculia), Other Health Impairment (ADHD), Emotional Disturbance, or Speech/Language Impairment.
- Section 504 Plan Status: Identification of medical, psychological, or neurological impairments requiring accommodations.
- Specialized IEP Accommodations: Details on individual testing supports, such as separate quiet room administration, sensory breaks, text-to-speech software, scribe assistance, and extended time allowances.
- Language Proficiency Ratings: Specific developmental linguistics baselines and ELPAC oral/written language assessment scores.
Sensitive Medical & Psychological Classifications Exposed
Under federal and state law, a child's psychological evaluation, psychiatric diagnoses, and special education status are among the most sensitive personal data in existence. When disability labels and testing accommodations are exfiltrated, it creates genuine risks of stigmatization, profiling, and targeted social engineering schemes directed at vulnerable families.
Parent Rights Under FERPA and California Law
As a parent of a child receiving special education or 504 accommodations in California, you are protected by rigorous privacy statutes that govern educational and psychological records:
- The Family Educational Rights and Privacy Act (FERPA, 34 C.F.R. Part 99): FERPA strictly prohibits public agencies from disclosing personally identifiable student information without prior parental consent, except under narrow statutory exceptions that mandate strict security controls by third-party contractors.
- California Student Online Personal Information Protection Act (SOPIPA): California law prohibits educational technology vendors and state contractors from using student data for unauthorized purposes and mandates strict industry-standard security safeguards.
- California Education Code § 56504 (5-Day Educational Records Inspection): Parents have the right to inspect and receive copies of all educational records within five business days of a written request, before any IEP meeting or due process hearing. If you suspect your child's testing or psychological records were altered, leaked, or mishandled, you have immediate access rights.
4 Immediate Steps Special Education Parents Must Take
If your child attended a California public school or charter school between 2023 and 2026 and took CAASPP or ELPAC assessments with an IEP or 504 Plan, take these proactive protective steps:
1 Enroll in Complimentary Identity Monitoring
ETS and CDE are offering two years of free credit and identity protection through Experian IdentityWorks. Check the official letter sent by your district (such as Palm Springs Unified or your local county office of education) to locate your child's unique activation code, or contact the state ETS incident response team.
2 Audit Your Child's Complete Special Education File
Submit a formal written request citing California Education Code § 56504 for a full copy of your student's cumulative file, confidential psychological testing folders, and accommodation verification sheets to confirm exactly what testing records were transmitted to state contractors.
3 Verify Standardized Testing Accommodations Fidelity
Cross-reference your child's current IEP or 504 document against the state testing logs. If the school failed to enter the legally mandated accommodations—or entered incorrect testing profiles—the resulting scores are diagnostically invalid and cannot be used to justify reducing specialized academic instruction.
4 Maintain Private, Independent Assessment Records
When you obtain an Independent Educational Evaluation (IEE), your evaluator's comprehensive raw data and psychometric profiles remain strictly between you and your clinician until you formally choose to present them to the IEP team.
How CAS Evaluations Protects Sensitive Psychological Records
At Comprehensive Assessment Services (CAS Evaluations), led by Licensed Educational Psychologist Donald Ghrist (LEP #2703), we adhere to the most stringent medical and educational data confidentiality protocols in California:
- Direct-to-Parent Privilege: All independent psychoeducational, speech-language, and occupational therapy evaluations are provided directly to the parent or legal guardian. The school district receives only the finalized assessment document that you authorize for your IEP meeting.
- HIPAA & FERPA Compliant Encryption: All electronic communication, diagnostic protocols, and raw testing protocols are stored in end-to-end encrypted repositories that exceed federal security standards.
- Zero Secondary Data Monetization: We do not upload clinical evaluations to third-party marketing or testing networks. Your child's cognitive, behavioral, and neurological assessments remain private clinical assets.
Frequently Asked Questions: CDE Data Breach & Student Privacy
What student information was exposed in the California Department of Education ETS data breach?
The cybersecurity breach at state contractor Educational Testing Service (ETS) compromised files containing student names, birthdates, addresses, school districts, statewide student identifiers (SSIDs), demographic data, English learner classifications, Section 504 plan status, disability codes, standardized test accommodations, and assessment scores. Social Security numbers and banking information were not involved.
Were special education IEP accommodations and 504 plans leaked?
Yes. Because ETS administers California's standardized state testing batteries (CAASPP and ELPAC), its data files include designated testing supports, specialized accommodations, and disability classifications utilized by students with IEPs and Section 504 Plans over the past three school years.
What rights do parents have under FERPA regarding breached special education data?
Under the Family Educational Rights and Privacy Act (FERPA, 34 C.F.R. Part 99) and California Education Code § 49060 et seq., parents have the legal right to inspect all educational records maintained by their district within five business days (Cal. Ed. Code § 56504), receive formal breach notifications, and seek accountability if confidential psychological or disability records are unlawfully disclosed.
How can affected California families claim the free identity theft protection?
The California Department of Education and ETS are providing two years of complimentary credit and identity monitoring services through Experian IdentityWorks for impacted students. Parents should check official communications from their local school district or visit the CDE ETS breach portal to obtain their unique activation code.
Need Independent, Defensible Assessment Clarity?
If your child's testing was compromised, delayed, or conducted without appropriate diagnostic accommodations, CAS Evaluations provides comprehensive Independent Educational Evaluations (IEEs) statewide.