ETS and Frontline breaches: what California notices say was exposed

What the documents cover, and what is missing

This guide draws on three documents: a notice of data breach that the California Department of Education (CDE) filed with the California Attorney General, the Attorney General's database record for that filing, and a Frontline Education sample notification filed with the Attorney General and dated October 26, 2026. None of them is a notice from the Kern County Superintendent of Schools. This guide therefore says nothing about what a Kern County notice states or whom it names.

The two incidents are separate. One involves a testing vendor and a state education agency. The other involves a school-administration software vendor and a school district.

Who notified whom in the ETS incident

The CDE notice opens by naming the sender and the direction it came from. It says Educational Testing Service (ETS) is notifying California students and families, and that it does so at CDE's direction.

The notice describes ETS's role. It says ETS is a nonprofit under contract with the State of California to provide state and federally required testing to all students enrolled in California public schools.

The Attorney General's database record lists the organization name as CDE, not ETS. It gives the breach date as Friday, May 22, 2026. Anyone searching the database for this incident should search under CDE.

What happened at ETS

The CDE notice says ETS identified unauthorized activity on September 25, 2026. The activity involved a secure file transfer protocol (SFTP) site used to exchange statewide assessment information with CDE.

The notice says the investigation found an unauthorized party using a compromised login credential at various times between May 22, 2026 and September 18, 2026. The notice states that this access was used to copy files containing California student information.

On containment, the notice says ETS disabled the account involved, took the affected SFTP site offline and began an investigation with outside cybersecurity experts.

What student data the CDE notice lists

The notice defines the scope broadly. It says the information accessed and copied was about California students, including but not limited to all students enrolled in the three previous school years.

It says what was exposed varies by individual and "may include" several categories. The first is identity and school details: student name, date of birth, residential address, school, district and grade level.

The notice also lists the Statewide Student Identifier (SSID) and a local student identifier.

It lists disability-related fields as well: disability and Section 504 status, testing accommodations and primary disability type.

It lists program eligibility for Title I, Part A; Title I, Part C; McKinney-Vento; and Military Connected Student.

The notice does not list the sensitive identifiers many breach notices carry. It says the data did not include Social Security numbers, driver's license numbers, passport numbers, financial account information, card information or account passwords.

It also says parent or guardian information was not involved.

What the state and ETS say they are doing

The CDE notice splits the response between ETS and the state. For the state, it says CDE and the State Board of Education are working with state cybersecurity experts to assess the effect on students and families. It adds that the California Cybersecurity Integration Center (Cal-CSIC) is assisting with digital forensics and incident response support.

The notice says ETS is providing identity-protection services through Experian IdentityWorks for 2 years, free to affected current and former students.

The notice gives two different adult enrollment deadlines. The main text says adults enroll on or before March 19, 2027. The adult section of the attachment says the code will not work after March 19, 2029. The notice does not reconcile the two dates, so a reader should check which one applies.

The Frontline Education notice

Frontline's letter is a sample adult notification addressed from the vendor to individuals. It says the company is writing about a cybersecurity event affecting personal information that it processes in connection with services it provides to a school district. The district name is blank in the sample.

The letter gives its own timeline. It says that on August 14, 2026, Frontline's security team found a vulnerability in a third-party software product that allowed unauthorized access to a portion of the environment beginning August 14, 2026.

The sample does not show what data was taken. The letter says Frontline analyzed the impacted files to determine what information they contained and whom it belongs to. The sentence that should name the data reads "We have determined that your were obtained," with the data type left out. On this sample alone, a reader cannot say whether the exposed data covers students, staff or both.

Frontline's remedy is a different product from the one in the ETS notice. It offers a 24-month TransUnion credit monitoring membership at no cost.

The sample gives two enrollment limits. The main letter says to enroll by January 31, 2027. Attachment A says to enroll within 90 days of the date of the letter. Attachment A also says the service may not be available to minors under 18, which fits a sample titled for adults.

Side by side

On who notified whom, the CDE notice says ETS sends it at CDE's direction, and the database record is filed under CDE. In the Frontline sample, the vendor writes to individuals itself and refers to a school district it serves.

On what was exposed, the CDE notice is specific: a list of student fields, plus a list of identifiers that were not included. The Frontline sample is not specific, because the data description is blank.

On cause, the CDE notice says a compromised login credential was used on an SFTP site. The Frontline sample says a vulnerability in third-party software allowed access.

A staff-data question remains open on these documents. The CDE notice is about students and says parent or guardian information was not involved. The Frontline sample does not name the people whose data was obtained.