ETS and Paradigm Breaches: Two California Government Contractors, Two Separate Data Incidents

Status (22 October 2026, 17:34 Cyprus time (UTC+3)): Monitoring. Two separate data breaches at contractors to California state agencies are now in the notification stage. ETS (Educational Testing Service), which runs statewide testing under contract with the California Department of Education (CDE), says an unauthorized party used a compromised login to copy student files from an ETS file transfer site; no total count of affected students has been published. Paradigm Healthcare Services, which processes Medi-Cal billing for the California Department of Health Care Services (DHCS), reported a breach affecting 970,403 individuals to the US Department of Health and Human Services (HHS). No source we found connects the two incidents. There is no CVE for either.

TL;DR: Two separate cases, one common thread: a state agency's data exposed on a contractor's system. ETS: an unauthorized party used a compromised credential between 22 May and 18 September 2026 to copy California student files, including names, dates of birth, addresses, Statewide Student Identifiers, and disability and assessment information. ETS identified the activity on 25 September 2026 and is offering two years of Experian IdentityWorks (CDE notice). Paradigm: it became aware of unauthorized access to its local network on 13 October 2025, and on 18 August 2026 determined that files containing names, dates of birth, gender and Medi-Cal member identification numbers may have been accessed (Paradigm notice). What to do now (Rescana guidance): if you are affected, follow the guidance in each notice and be wary of unsolicited contacts about these incidents. If you are a public body or a contractor, check which suppliers hold your agency's data and how fast they will tell you when something goes wrong.

Technical Information

ETS and California student data

Who the contractor is. ETS describes itself as "a nonprofit assessment organization under contract with the State of California to provide state and federally required testing to all students enrolled in California public schools". It runs California's statewide assessment programs, including CAASPP and ELPAC (ETS Notice of Data Breach). CDE's 2 October letter to school leaders describes ETS as "a private company under contract with the State of California" (CDE letter).

What happened. According to the notice, on 25 September 2026 ETS "identified unauthorized activity involving an SFTP site used to exchange California statewide assessment information with CDE". ETS disabled the account involved, took the site offline and began an investigation with external cybersecurity experts. The investigation found that "an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026 to access the SFTP site to copy files containing California student information".

Who is affected. The notice says information about California students, "including but not limited to all students enrolled in the three previous school years", was accessed and copied. CDE's incident FAQ adds that affected individuals include current and former students enrolled in California public schools between 2023 and the current school year, "as well as students who left a California school since 2006 and did not confirm transfer to another school with the CDE" (CDE ETS incident page). Neither ETS nor CDE has published a total count. CDE also notes that not receiving a letter "does not necessarily mean" a student was unaffected.

Data involved. The data varies by person, but may include: name, date of birth, home address, school, district and grade; Statewide Student Identifier (SSID) and local student identifier; gender, race or ethnicity, primary language, country of origin and English learner status; disability and Section 504 status, testing accommodations and primary disability type; eligibility for Title I, McKinney-Vento and Military Connected Student programmes; and English proficiency and statewide assessment information. The notice says the data did not include Social Security numbers, driver's licence or passport numbers, financial account or card information, or account passwords, and did not involve parent or guardian information.

Response. ETS says it took the SFTP site offline and built "an entirely new SFTP site with enhanced security controls". It also says that, after working with law enforcement and cybersecurity experts, it "has taken steps to reduce the potential risk of the data being made publicly accessible". ETS does not say what those steps were. It adds that its web monitoring has "to date, not uncovered any evidence that the information has been made public" (CDE release). On the state side, the California Cybersecurity Integration Center (Cal-CSIC) is assisting with forensics and incident response, supported by the California Department of Technology and Cal OES. CDE and the State Board of Education are "reviewing the incident and ETS's compliance with applicable data security and contractual requirements".

Operational impact. CDE's 2 October letter told county and district superintendents and charter school administrators that ETS "has halted normal enrollment data processing and paused certain testing activities while the security of its systems are assessed". A day earlier, on 1 October, the official CAASPP & ELPAC website had told local coordinators that ETS was "currently unable to process the nightly enrollment files". Testing was paused for students whose records were added or updated on or after 25 September (CAASPP & ELPAC email update). That email does not mention a security incident.

Filings. The California Attorney General's breach list carries an entry under the name "CDE", with a breach date of 22 May 2026 and a reported date of 16 October 2026. Its sample notice is the ETS Notice of Data Breach (California AG listing). We found no separate entry under ETS's own name.

Paradigm and Medi-Cal member data

Who the contractor is. Paradigm describes itself as "a third-party service provider that processes Medi-Cal (California's Medicaid program) billing and maintains Medi-Cal member identification numbers on behalf of and pursuant to a Data Use Agreement with the California Department of Health Care Services" (Paradigm notice). In its HHS filing, Paradigm is listed as a "Business Associate".

What happened. Paradigm says that on 13 October 2025 it "became aware of unauthorized access to its local network". On 18 August 2026, it "determined that certain files containing select individuals' protected health information may have been accessed by an unauthorized party between October 8, 2025, and October 15, 2025". Paradigm says its online service documentation and billing platform, Student Health Network (SHN), "was not impacted".

Data involved. Name, date of birth, gender and Medi-Cal member identification number. The notice does not list Social Security numbers or financial information.

Affected count. The HHS Office for Civil Rights breach portal lists Paradigm Healthcare Services (California, Business Associate) with 970,403 individuals affected. The breach was submitted on 14 September 2026, with the type "Hacking/IT Incident" and the location "Network Server" (HHS OCR breach portal).

Response. Paradigm says it took "certain systems offline", notified law enforcement, and engaged incident-response professionals to investigate. It says it has "no evidence that any of your information has been used to commit fraud or identity theft as a result of this incident".

Notification and support. The sample letter filed with the California Attorney General is dated 14 September 2026. The AG's list records the breach dates as 8 to 15 October 2025 and the reported date as 14 September 2026 (California AG listing). The notice recommends a fraud alert, a security freeze and free credit reports, and gives medical identity theft guidance. Neither the public notice nor the filed sample letter offers credit monitoring.

Are the two incidents connected?

We found no source that links them. They involve different contractors, different state agencies (CDE and DHCS), different systems (an SFTP site and a local network), different intrusion windows (May to September 2026, and October 2025) and different data. We cover them together only because both show the same TPRM pattern: a public body's data held by a contractor, and exposed there.

Timeline

All dates are 2026 unless stated. The primary sources give dates only, in a US Pacific time context.

Paradigm

8–15 October 2025: Window in which files "may have been accessed" (Paradigm notice; California AG listing).
13 October 2025: Paradigm becomes aware of unauthorized access to its local network.
18 August: Paradigm determines that files containing protected health information may have been accessed.
14 September: Notification letters dated, breach submitted to HHS OCR, and sample notice reported to the California AG.

ETS

22 May – 18 September: Unauthorized party uses a compromised credential "at various times" to copy files from the ETS SFTP site.
25 September: ETS identifies the unauthorized activity, disables the account and takes the site offline.
1 October: CAASPP & ELPAC website tells local coordinators ETS cannot process nightly enrollment files.
2 October: CDE letter to county and district superintendents and charter school administrators, reporting "an incident involving ETS-operated systems".
16 October: CDE news release. ETS notifications begin, and the California AG list records the report under "CDE".
Early November: CDE expects notification distribution to be complete.
19 March 2027: Enrollment deadline for the Experian IdentityWorks offer, per the notice and the CDE FAQ (one line in the notice's adult enrolment instructions says 19 March 2029).

What we know and what we don't

Not known or not stated:

ETS: how the credential was compromised, who the intruder is, and the total number of students affected. Neither the notice nor the CDE pages say.
ETS: what "steps to reduce the potential risk of the data being made publicly accessible" involved.
Paradigm: how the attackers got in, who they are, and whether files were taken (the notice says "may have been accessed"). SecurityWeek reports that "No known cybercrime group appears to have taken credit" for an attack on Paradigm (SecurityWeek).
Both: whether either agency's own systems were affected. Neither source says they were, and we do not assume it.
Both: any statement from DHCS about Paradigm. We found none as of 22 October 2026, 17:34 Cyprus time (UTC+3).

Affected Product Versions

No software versions are involved; these are data breaches at two service providers. ETS: California student records on the ETS SFTP site, as scoped above; no total count has been published. Paradigm: Medi-Cal member data on Paradigm's local network; HHS OCR lists 970,403 individuals, and Paradigm says its SHN platform "was not impacted".

Workaround and Mitigation

Guidance from ETS and CDE (student data)

Enrol in the free identity protection if you get a letter. It is free and needs no credit card. The notice and FAQ give an enrolment deadline of 19 March 2027 for both packages, although one line in the adult instructions says 19 March 2029. Rescana guidance: enrol by 19 March 2027 and confirm on the CDE notification page. Minors are enrolled by a parent or guardian, and adults enrol themselves. Details are on the CDE notification page.
Don't assume you are unaffected if no letter arrives. CDE says some current and former students may not receive one, especially if their contact details have changed.
Treat unsolicited contacts with care. Be cautious of emails, texts or calls claiming to be from ETS, CDE or Experian, or referring to a student's school or tests. Check enrolment URLs before entering details. Call 833-931-8488, Monday to Friday, 6:00 am to 6:00 pm Pacific Time (currently 16:00 to 04:00 Cyprus time, UTC+3).
Consider credit freezes. Adults can freeze their own files. Parents and guardians can request a free freeze for children under 16.

Guidance from Paradigm (Medi-Cal data)

Watch your health benefit statements. Review explanation-of-benefits statements, ask for a year-to-date list of services paid, and only share insurance cards with providers and covered family members.
Consider a fraud alert and a security freeze with Equifax, Experian and TransUnion, and get your free credit reports at annualcreditreport.com.
Call Paradigm's response line with questions: 1-833-851-9382.

Rescana guidance

Plan for targeted phishing. Both datasets include names and dates of birth, and the ETS data includes addresses and school details. That is enough to make a convincing scam message. Schools, districts, health plans and providers should remind families and members not to share passwords, payment details or other personal information in response to unsolicited messages about these incidents, in line with CDE's own advice.
Watch for misuse of identifiers. SSIDs and Medi-Cal member ID numbers are not secret in the way passwords are, but they can still be used to make scams sound convincing. Organisations that accept these IDs as proof of identity should not rely on them alone.

Contractor risk for public bodies (Rescana guidance)

In both cases, the data belongs to a public programme, but it was exposed on a contractor's system. The students and Medi-Cal members whose data was involved did not choose these suppliers. A contractor breach still lands on the agency in practice: CDE is distributing ETS's notice, the AG entry is filed under "CDE", and CDE is reviewing ETS's compliance with its contract.

Detection and notification timing. From the dates in the sources: in the ETS case, access ran for about four months before it was identified, and family notifications began 21 days after detection. In the Paradigm case, the letters are dated 27 days after Paradigm's 18 August 2026 determination and about 11 months after it became aware of the access. We do not comment on whether either timeline met legal requirements. The point is that an agency's ability to act depends on how quickly its supplier detects a problem and tells it.

Contract clauses to review:

Notification to the agency within a defined number of hours of suspected unauthorized access, not only after confirmed data loss.
Multi-factor authentication and IP restrictions on every account that can reach agency data, including file transfer accounts.
Data minimisation and retention limits, so that a contractor holds only the records and years it needs.
Agency rights to forensic summaries, named responsibility for notification and credit monitoring, and flow-down of these terms to subcontractors.

Indicators of Compromise

Neither ETS, CDE nor Paradigm has published indicators of compromise, and we have none to list. We have not inferred any. We will add indicators here if a primary source publishes them.

What we will update

We will update this advisory if:

ETS or CDE publishes a total count of affected students, or new detail on how the credential was compromised.
ETS reports any evidence that the data has been published.
CDE or the State Board announces the outcome of its review of ETS's compliance.
DHCS or Paradigm publishes further detail, or the HHS OCR entry changes.
Any regulator or law enforcement body makes a public statement on either incident.
Any primary source links the two incidents.

Sources

California Department of Education: news release (16 Oct 2026); ETS Notice of Data Breach (PDF) and notification page (last reviewed 19 Oct 2026); ETS incident page and FAQ (last reviewed 16 Oct 2026); Vendor Incident Report letter (2 Oct 2026)
CAASPP & ELPAC: Guidance Regarding the File Processing Delays (email update, 1 Oct 2026)
California Attorney General: breach listings for "CDE" (reported 16 Oct 2026) and "Paradigm Healthcare Services" (reported 14 Sep 2026)
Paradigm Healthcare Services: Notice of Data Breach
US Department of Health and Human Services, Office for Civil Rights: breach portal (Paradigm Healthcare Services entry, submitted 14 Sep 2026)
SecurityWeek, cited only for the claim-of-responsibility point: Paradigm report (20 Oct 2026)

Why this matters for vendor risk

In both cases, state-held student and Medi-Cal data was exposed on a contractor's system (one through a compromised SFTP login, the other through a network intrusion), and no source reports a breach of either agency's own systems. If your organisation sends regulated data to contractors, your exposure includes the file transfer accounts and servers they run, not just the systems you can see.

Forward this to your TPRM owner: If you share personal data with a contractor, ask this week which systems hold or move your data and who can log in to them, how file transfer and service accounts are protected and monitored, how many years of your records they keep, and how many hours it would take them to tell you about suspicious access (Rescana guidance).

Want a clearer, evidence-based view of how your contractors and their suppliers handle your data? Talk to Rescana.