According to state officials, the information involved varies by student but may include names, Statewide Student Identifiers, dates of birth, addresses, demographic information, disability records, program participation information and statewide assessment results. Designed by Magnific

SACRAMENTO, CA (MPG) - California students and families are receiving notifications following a data security breach involving a company contracted by the state to administer student assessments. The incident exposed student information, including names, birth dates, addresses and assessment records.

Educational Testing Service (ETS), a nonprofit organization under contract with the California Department of Education (CDE), reported that an unauthorized party accessed and copied student information from a secure file transfer site operated by the company.

The CDE began distributing breach notifications Oct. 16 and expects the process to continue through early November. The department has not disclosed how many students the incident affected or which school districts may have had student information compromised.

According to state officials, the information involved varies by student but may include names, Statewide Student Identifiers, dates of birth, addresses, demographic information, disability records, program participation information and statewide assessment results.

The breach did not involve Social Security numbers, financial account information, passwords or parent and guardian information, according to ETS.

The company reported that it took the affected file transfer site offline and built a replacement system with additional security controls. ETS also worked with law enforcement and cybersecurity experts to investigate the incident and reduce the possibility of the information becoming publicly accessible.

ETS reported that its ongoing monitoring has found no evidence that the compromised information has appeared publicly.

The CDE and State Board of Education began coordinating with state cybersecurity agencies after ETS disclosed the incident. Their response includes determining which records the breach affected and providing information and resources to students and families.

In an Oct. 2 letter to county and district superintendents and charter school administrators, Deputy Superintendent of Public Instruction Mary Nicely reported that ETS had suspended normal enrollment data processing and paused certain testing activities while officials assessed the security of its systems.

"Protecting California students and their information is our top priority," Nicely wrote. "The CDE and SBE are taking this incident extremely seriously and are working to ensure that any affected students and families are identified, notified, and provided appropriate information and support as quickly as possible."

The department said it was working to minimize disruptions to statewide assessments. Officials have not provided a timetable for resuming the affected activities.

ETS is offering current and former students affected by the breach two years of identity protection services through Experian IdentityWorks at no cost.

The CDE has published the breach notification in 27 languages to help families understand the incident and access available services.

Students and families can review the ETS Notice of Data Breach at https://www.cde.ca.gov/nr/in/ets-notification.asp or visit the CDE incident information page https://www.cde.ca.gov/ets for updates and instructions on obtaining identity protection services.