After the 2026 ETS Data Security Incident, How Can Student Families Verify Notices?

As of the California Department of Education’s current guidance, verify any ETS incident notice through the department’s official event page and notification resources—not by judging the email’s appearance. The department says the information involved varies by person; Social Security numbers, financial account information, passwords, and parent or guardian information were not involved. Read the department’s ETS incident page before acting on an unexpected message.

This guide is for California students who currently attend or previously attended school, and for their parents or caregivers checking whether a notice may apply to their family.
It is also for anyone who has received a message claiming to come from ETS, a school, or the state education department and wants to verify it safely.

Key takeaway: An email’s branding is not proof. The official event page is your reference point.

Last updated October 20, 2026. Details checked against the California Department of Education’s October 16 announcement, its ETS incident page, and its notification page. Check those pages again for later updates.

What the official update confirms

The California Department of Education has confirmed that an ETS-operated SFTP site experienced unauthorized access and that student information was copied. The department says notification distribution began on October 16, 2026, and is expected to continue through early November. Those dates describe the official notification process; they do not establish a personal deadline for you to respond. See the department’s announcement and notification guidance.

The scope is not necessarily the same for every person. The department says the information involved varies by individual. It also states that Social Security numbers, financial account information, passwords, and parent or guardian information were not involved. Use that wording as the current boundary of confirmed information. Do not infer that another type of data—such as an email address—was exposed unless an official update specifically says so. The incident page provides the department’s current description.

That distinction matters when you receive a message. A notice about an incident does not, by itself, mean that every student’s information was affected in the same way. And a message claiming that a particular sensitive detail was stolen is not proof. Check whether the official page confirms the claim before sharing it or taking action based on it.

The department’s event page and notification page are the sources to revisit. A search result, forwarded message, social post, or copied screenshot may be incomplete or out of date. If information changes, rely on the current official pages and their stated contact routes rather than a sender’s interpretation.

A quick decision guide for each family

Use this comparison to decide what to do next. “Best fit” means the source is appropriate for that task; it does not certify an email as genuine.

The official pages are the strongest source for the event’s confirmed scope. The message is useful only as something to inspect—not as evidence that its claims are true. A familiar logo, a school name in the sender field, or a polished layout can be copied. Conversely, a message that looks plain is not automatically fraudulent. Verify the source independently in either case.

A simple way to keep your decision consistent is to rate each source by purpose:

• Official event page: high confidence for confirmed facts. Use it to check the incident description and current scope.
• Official notification page: high confidence for distribution guidance. Use it to understand how notices are being handled and where questions should go.
• Unsolicited email: low confidence until independently verified. Do not let a deadline, threat, or request for information in the message push you past the official check.
• Forwarded copy: low confidence as a final source. It may omit context or refer to an older version of the guidance.

These ratings are a decision aid, not a judgment about any specific email. The department’s published guidance remains the authority for event facts and official contact options.

For students waiting for a notice

Not receiving an email yet does not tell you whether your information was involved. The department says notifications began on October 16 and are expected to continue through early November. Because distribution is continuing, the absence of a message at a particular moment is not a reliable way to confirm that you are outside the scope—or that you are included. Check the department’s notification page for current guidance.

Use this process instead:

• Open the official incident page independently. Type the California Department of Education address into your browser or use a trusted bookmark. Do not use a link from an unexpected email or a forwarded post.
• Read the stated scope. Compare the official description with your own situation. The department says information involved differs by person, so avoid applying another student’s experience to yourself.
• Review the notification guidance. Check the current instructions and the contact method published there. Do not guess which email address the department will use or invent a response deadline.
• Ask through an official route if you remain unsure. Use contact information listed on the department’s site or contact your school through a channel you already trust. Do not reply to a suspicious message to ask whether it is genuine.
• Return to the official page for updates. If you save a copy of a notice or guidance page for your records, check the live page before relying on that saved version.

If your family has not received a notice, do not let uncertainty lead you to share personal information with an unverified sender. The official pages—not an email’s urgency—should determine whether you need to take a next step.

For parents and caregivers reviewing a family notice

Start by checking the information the official page says was not involved: Social Security numbers, financial account information, passwords, and parent or guardian information. That statement does not mean you should ignore a genuine notification. It does mean you should not interpret an email as evidence that those details were exposed when the department’s current description says otherwise. Review the department’s incident information.

Next, separate the notice into two parts: what it claims happened and what it asks you to do. Verify the event claim against the official page. Then check whether the requested action also appears in official guidance. A message may refer to a real incident while adding an unrelated request, a misleading link, or a false claim about what information was affected.

For a school-age child, avoid forwarding a suspicious message around a family or school group as if it were confirmed. That can spread an unverified claim and make later checking harder. If you need to preserve it, keep the original message and note where it arrived. Use the official page’s published contact route to ask questions about the notice.

If the message asks you to sign in, pay a fee, provide financial details, send a password, or share a verification code, stop. Do not enter those details through the email’s link. The official event page is where you should confirm the department’s instructions; it is not necessary to act just because a message uses urgent language.

For future registrations unrelated to an official education notice, decide whether the account needs to remain recoverable before choosing an email address. A guide to email aliases and separating account messages can help you think through the trade-offs. An event notice or school-related account belongs in the long-term-access category.

For anyone checking a suspicious message

Use a source-first check rather than a visual inspection. Sender names can be displayed in ways that do not prove who controls the sending address. Links can also show one label while opening a different destination. Neither a logo nor a familiar school name is enough to establish authenticity.

Follow these steps:

• Do not click the message link. Open the official event page separately. If the message describes a new instruction, look for the same instruction on the official page.
• Inspect the actual sender address. Compare it with details published by the relevant organization. A display name alone is weak evidence. If the address is unfamiliar or does not match official guidance, do not reply or provide information.
• Check the destination without opening it. On a computer, you may be able to hover over a link to preview its destination; on a phone, press-and-hold behavior varies, so do not rely on it if you are unsure. The safer option is to navigate to the official site yourself.
• Look for requests that are unrelated to verification. Requests for a password, verification code, or financial information should not be answered through an unexpected message. Confirm any requested action through a separately obtained official contact route.
• Keep the message for comparison. Preserve the original if you need to discuss it with a school or the department. Avoid sharing it broadly as confirmed information while you are checking it.

These checks help with phishing email identification, but they do not replace official confirmation. If an email resembles a real notice and still feels uncertain, contact the organization using information published on its official site—not the reply address or phone number embedded in the suspicious message.

For other signup messages, not event notices, you can also use a step-by-step guide to checking verification emails. It covers how to assess a confirmation message and its links. If a code for an unrelated account does not arrive, check the service’s official help instructions, confirm that you entered the right address, and avoid repeatedly clicking links or sharing codes with someone who contacted you.

Pause before acting: A request to “verify your identity” does not make a message legitimate. Confirm the request on the official site first.

What to save and what not to assume

Keep a copy of a notice you believe may be relevant, along with the date you received it and the sender details shown by your email service. This can help you compare the message with later official guidance or explain your question to the department. Do not edit the original message in a way that removes its sender or link information.

At the same time, keep the record factual. Note what the message says; do not label its claims as confirmed until you have checked them against the official event page. If a message names a type of information not listed by the department, treat that as an unverified claim. Do not conclude that the information was exposed—or that it was definitely not exposed—based only on the sender’s wording.

The official description can change if the department publishes new information. Return to the incident and notification pages before relying on an older saved screenshot or a family member’s forwarded copy. If the department updates the scope, use that update to guide your next step. Until then, do not invent a notification deadline or assume that silence from your inbox settles the question.

Frequently asked questions

How can I tell whether an ETS incident notice is genuine?

Do not decide from the logo, sender display name, or urgent wording alone. Open the California Department of Education ETS incident page independently, compare its current guidance with the message, and use contact details published on the official page if you still have doubts. Avoid entering credentials or personal details through a link in an unexpected email.

What student information did the ETS incident involve?

The California Department of Education says the information involved varies by person. Its current notice says Social Security numbers, financial account information, passwords, and parent or guardian information were not involved. Do not assume that every student had the same information affected, and do not treat email addresses or other unlisted data as exposed unless an official update confirms it.

Where should I check if no ETS notification has arrived?

Use the California Department of Education's ETS incident and notification pages for the current scope, distribution guidance, and official contact route. The department says notifications began on October 16 and are expected to continue through early November. Since notices are being distributed over time, not receiving one yet does not establish whether you are or are not affected.

How should I check a link that claims to come from my school or ETS?

Do not open the link from the message. Visit the relevant school or California Department of Education site by typing its address yourself or using a saved, trusted bookmark. Compare the notice with official event-page information, and contact the school or department through a number or address published independently. Never send a password, verification code, or financial details in response to an unexpected request.

For ETS-related questions, keep using the California Department of Education’s official event and notification pages; a temporary email address cannot verify a notice or protect an education account. MsgMask may be relevant to a separate, low-stakes signup when you do not want to give that service your primary address, but not for official notices or accounts you may need to recover. Before choosing an address for another registration, use the email-selection guide above and keep long-term accounts tied to an inbox you can continue to access.

Frequently asked questions