CDE Data Breach Lawsuit Investigation
Received a September 2026 breach notice from CDE?
Dapeer Law, P.A. is investigating a potential class action on behalf of current and former California students and their families whose statewide assessment data may have been copied in a cyber incident involving the California Department of Education (CDE) and its testing vendor, Educational Testing Service (ETS), which was disclosed in October 2026.
Who may qualify
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from CDE dated September 2026.
- Your letter offered enrollment in two years of free Experian IdentityWorks identity protection, with separate packages for minors and adult former students.
- You, or your child, were a California public school student enrolled during the past three school years whose statewide assessment information was exchanged between CDE and ETS.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened
According to the notice filed with the California Attorney General, Educational Testing Service (ETS), which administers statewide assessments for the California Department of Education, identified unauthorized activity on September 25, 2026 on an SFTP site used to exchange statewide assessment information with CDE. ETS reports that a compromised login credential was used at various times from May 22 to September 18, 2026, and that the unauthorized party was able to access and copy files containing student information. ETS disabled the affected account, took the SFTP site offline, and engaged outside cybersecurity experts.
The notice was published on October 16, 2026. It states that the copied files contained assessment-related data for students enrolled over the past three school years, and that the information varied by student. Reported data elements may include names, dates of birth, home addresses, school, district, grade level, Statewide Student Identifiers, gender, race or ethnicity, primary language, country of origin, English learner status, disability and Section 504 status, testing accommodations, program eligibility (Title I, McKinney-Vento, and Military Connected Student), and assessment registration, participation, and results. The notice states that Social Security numbers, driver's license numbers, financial account information, and parent or guardian information were not involved. ETS is offering two years of complimentary Experian IdentityWorks identity protection.
Although no Social Security numbers were reported, the files appear to include sensitive information about children, such as disability status, testing accommodations, and program eligibility, which cannot be changed once exposed. Children's information can also be misused for years before anyone checks for it. Our investigation is examining whether reasonable safeguards, such as multi-factor authentication and access monitoring, were in place on the SFTP site, why the unauthorized access went undetected for nearly four months, and what responsibilities ETS and CDE had to protect student records.
What to do if you received a letter
Keep your notice letter
Do not discard your CDE or ETS breach notice. The letter contains the enrollment instructions for the free Experian IdentityWorks service and documents the categories of student information involved, which is important evidence if you decide to participate in a lawsuit.
Enroll in the free 24-month identity protection
Enroll in the Experian IdentityWorks package offered in your letter (the minor package for current students, the adult package for former students) before the stated deadline. Enrollment is free and does not require a credit card. Accepting this benefit does not waive your right to pursue legal action.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide. Parents and guardians may also want to ask each of the three credit bureaus whether a credit file exists in a minor student's name, since one generally should not. Be alert for phishing emails, texts, or calls that reference schools, statewide testing, or this incident, and verify web addresses before entering personal information on any identity-protection site.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We'll review your CDE or ETS notice, explain your options, and advise whether you or your child may be eligible to join a class action.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
Breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring stronger protection of student assessment records going forward, including multi-factor authentication and monitoring on file transfer systems, data minimization, and closer oversight of testing vendors.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
Common questions
I received a data breach letter from CDE. What should I do? +
Keep your notice letter and follow its instructions to enroll in the free Experian IdentityWorks service, using the minor package for current students or the adult package for former students. Watch for phishing attempts that reference schools, statewide assessments, or this incident, and verify web addresses before entering personal information. Parents may want to check whether a credit file exists in a child's name. Document any time or money you spend responding, and consider speaking with a data breach attorney about your options.
Am I eligible to join a class action against CDE? +
Current and former California students, and their parents or guardians, who received a CDE or ETS breach notice are likely candidates. The notice covers students enrolled during the past three school years whose assessment data was on the compromised SFTP site. Eligibility for any future class action will also depend on the categories of information involved and any documented losses or out-of-pocket expenses.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
According to the notice, the copied files contained student demographic, program eligibility, and statewide assessment information, which may include names, dates of birth, addresses, Statewide Student Identifiers, race or ethnicity, disability and Section 504 status, testing accommodations, English learner status, and test results. The notice states that no Social Security numbers, driver's license numbers, financial account information, or parent or guardian information were involved. The specific data varied by student, so your own letter is the most reliable source.
Did CDE offer free credit monitoring? +
Yes. ETS is offering two years of complimentary Experian IdentityWorks identity protection, with separate packages for minors and adult former students. Enrollment is free and does not require a credit card. The notice lists March 19, 2027 as the enrollment deadline for the minor package, so check your letter for the deadline that applies to you. Enrolling does not waive your right to bring a claim.
How many people were affected by the CDE breach? +
The notice does not disclose the total number of affected students. It covers students enrolled during the three prior school years whose assessment data was stored on the compromised SFTP site, which could be a large group given the statewide scope of the testing program. This page will be updated as more information becomes available.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
The notice is posted on the California Attorney General's data breach registry and is linked in the Sources & References section below. CDE also maintains an information page at cde.ca.gov/ets, and ETS has set up a call center at 833-931-8488. If you cannot locate your letter, Dapeer Law can help you obtain a copy as part of a free consultation.
Sources & references
- Official breach notice filing · California Attorney General, CDE / ETS Notice of Data Breach (PDF)
- Company · California Department of Education (CDE) (cde.ca.gov)
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
