California Student Data Breach: What BHUSD Families Should Know

The California Department of Education announced October 16 that Educational Testing Service has begun notifying students and families after student information was accessed and copied from a file-transfer site operated by the state testing contractor. Notifications are expected to continue into early November.

The official breach notice describes a broad statewide exposure:

Information about California students, including but not limited to all students enrolled in the three previous school years, was accessed and copied.

That description indicates that current and former Beverly Hills Unified School District students may be affected. BHUSD participates in California's CAASPP testing program, which ETS supports. The Standard has not independently confirmed individual BHUSD cases or a district-specific number. The state notice identifies an ETS-operated system as the site of the intrusion; it does not establish that BHUSD's own systems were breached.

According to CDE's incident explanation, ETS detected unauthorized activity on September 25, 2026. Investigators determined that someone used a compromised login credential to copy student files at various times between May 22 and September 18. ETS disabled the account and took the affected site offline.

The information varies by student. CDE says it may include names, birth dates, home addresses, student identification numbers, school and grade information, demographic details, disability and Section 504 status, testing accommodations, program eligibility and assessment results. Social Security numbers, financial account details, passwords and parent or guardian personal information were not involved, according to the notice.

CDE's guidance also includes former students who are now adults. It says the affected population includes students enrolled in California public schools from 2023 through the current school year, along with students who left a California school since 2006 without a confirmed transfer recorded with CDE.

ETS is offering affected individuals two years of Experian IdentityWorks services at no charge. Separate enrollment options are available for minors and adults. Families should confirm their applicable enrollment deadline using the official notice and incident helpline. Instructions and activation codes accompany the notification. Enrollment does not require a credit card.

CDE cautions that not receiving a letter does not establish that a student's information was unaffected, particularly when contact details have changed. Families should review the state's official incident page and be cautious of unsolicited messages seeking personal or financial information.

In its October 16 announcement, CDE said ETS had built a replacement file-transfer site with additional security controls. ETS reported that its web monitoring had found no evidence, to that date, that the copied information had been made public.

Questions about the incident can be directed to 833-931-8488, weekdays from 6 a.m. to 6 p.m. Pacific Time, excluding major U.S. holidays. CDE lists engagement number B174774 for students under 18 and B174775 for those 18 and older.