Chairman Cassidy Demands Answers and Action Regarding Cybersecurity Incident Affecting Millions of Students

WASHINGTON - U.S. Senator Bill Cassidy, M.D. (R-LA), Chairman of the U.S. Senate Health, Education, Labor, and Pensions (HELP) Committee, demanded answers from the Educational Testing Service (ETS) CEO after a cybersecurity incident exposed millions of current and former California students' private information to bad actors.

"Cybersecurity threats are one of the most significant risks currently affecting the safety and security of our most sensitive information," wrote Dr. Cassidy. "At a time when hostile actors are increasingly using sophisticated tactics leveraging artificial intelligence, it is essential for the education technology sector to take meaningful steps to safeguard student and consumer information."

ETS is the world's largest private educational testing and measurement organization, developing, administering and scoring more than 50 million tests. This cybersecurity incident leaked California students' names, dates of birth, residential addresses, demographic information, and disabilities. Cassidy is seeking further information from ETS to ensure this type of attack on Americans does not happen again.

As Chairman of the HELP Committee, Cassidy has led efforts to protect Americans' private data. His Health Care Cybersecurity and Resilience Act passed the U.S. Senate by unanimous consent and his Health Information Privacy Reform Act advanced out of committee. Cassidy has investigated several cybersecurity lapses, including those by NYC Health + Hospitals, Hims & Hers, Instructure, OPEXUS and UnitedHealth Group. These privacy and security lapses, increasingly led by hostile actors in China, Russia, and Iran, have only continued to proliferate and cause harm to Americans. The HELP Committee next Congress should continue to closely scrutinize how Americans' data is protected and steps to prevent its misuse.

Read the full letter here or below:

Dear Mr. Sevak,

Cybersecurity threats are one of the most significant risks currently affecting the safety and security of our most sensitive information. At a time when hostile actors are increasingly using sophisticated tactics leveraging artificial intelligence, it is essential for the education technology sector to take meaningful steps to safeguard student and consumer information.

The recent cybersecurity incident affecting Educational Testing Service (ETS) highlights the impact these growing threats have on disrupting our educational system. ETS provides assessment tools for approximately 50 million individuals annually across a student's educational career. The current investigation thus far indicates millions of current and former California students' information was accessed and copied, including "student names, dates of birth, residential addresses… demographic information… [and] disability [status]." The California Department of Education (CDE) oversees the largest public education system in the United States, managing over 5.7 million K-12 students.

Additional transparency is needed regarding what information threat actors accessed, what measures ETS had implemented prior to the incident to protect sensitive information, and what steps the company intends to take going forward to address vulnerabilities and improve its security infrastructure.

To that end, I request answers to the following questions by November 12, 2026:

1. What security protocols, both cyber and physical, does ETS have in place to protect against a cyberattack?
2. How does ETS incorporate cybersecurity best practices implemented by other critical infrastructure sectors?
3. When did ETS first become aware of a cyber incident affecting its systems?
4. When did ETS notify federal agencies of a cyber incident, and which agencies did ETS notify?
5. ETS has stated that "Affected individuals include current and former students enrolled in California public schools between 2023 and the current school year, as well as students who left a California school since 2006 and did not confirm transfer to another school with the CDE."
6. 1. What steps is ETS taking to fully identify what individuals were potentially impacted?
   2. How is ETS proactively communicating with potentially impacted individuals and entities, including the parents or guardians of potentially impacted children under age 18?
7. ETS thus far has indicated that "student demographic, program participation, and assessment data that ETS maintains in connection with California's statewide assessment programs" was accessed and copied.
8. 1. What steps is ETS taking to identify any additional information that may have been accessed?
9. ETS has stated that it "has taken steps to reduce the potential risk of the data being made publicly accessible."
10. 1. What steps has ETS taken to reduce the potential risk of data being made publicly available?
    2. Has ETS had any communications with the threat actor who accessed and copied the impacted information?

Sincerely,

###

For all news and updates from HELP Republicans, visit ourwebsite or Twitterat @GOPHELP.