Personal information belonging to current and former Beverly Hills Unified School District students may have been copied in a statewide data breach at California's testing contractor.
The California Department of Education (CDE) announced Oct. 16 that Educational Testing Service (ETS), the nonprofit organization that runs the state's standardized tests, began notifying families after an unauthorized party accessed and copied student files from an ETS-operated file-transfer site. Notifications are expected to continue into early November, according to a CDE press release issued under State Superintendent of Public Instruction Tony Thurmond.
BHUSD participates in the California Assessment of Student Performance and Progress (CAASPP) program that ETS supports, according to a district news release from June. That connection means district students' data was in the ETS system. The Beverly Hills Standard, which first reported the local angle Oct. 23, noted it had not confirmed individual BHUSD cases or a district-specific number. BHUSD's own systems were not breached; the intrusion occurred on an ETS-operated site.
ETS detected unauthorized activity on Sept. 25, according to the CDE incident page. Investigators found that someone used a compromised login credential to copy student files at various times between May 22 and Sept. 18. ETS disabled the account and took the site offline.
The exposed data varies by student. It may include names, birth dates, home addresses, student identification numbers, school and grade information, demographic details, disability and Section 504 status, testing accommodations, program eligibility and assessment results, according to the CDE breach notice. Social Security numbers, financial account information, passwords and parent or guardian personal information were not involved.
The affected population includes students enrolled in California public schools from 2023 through the current school year, according to CDE. It also includes students who left a California school since 2006 without a confirmed transfer recorded with CDE. That means some former BHUSD students who are adults could be affected.
ETS said its web monitoring had found no evidence, as of Oct. 16, that the copied data had been made public.
What BHUSD families should do
ETS is offering affected individuals two years of free Experian IdentityWorks identity-protection services. Enrollment does not require a credit card.
For students under 18, a parent or guardian can enroll at experianidworks.com/minorplus on or before March 19, 2027. For adults 18 and older, enrollment is at experianidworks.com/identity. The CDE notice lists March 19, 2027, as the enrollment deadline in one section and March 19, 2029, in another; families should confirm their applicable deadline using the official notification letter or the incident helpline.
CDE cautions that not receiving a notification letter does not mean a student's data was unaffected, particularly if contact information has changed.
The state warns families to watch for phishing. Do not share personal information, passwords or financial details in response to unsolicited emails, texts or calls referencing a student's school or this incident.
Families with questions can call 833-931-8488, weekdays, 6 a.m. to 6 p.m. Pacific time, excluding major U.S. holidays. The engagement number is B174774 for students under 18 and B174775 for those 18 and older.
