Earlier this month, families across California received a notice about their children’s school records. Educational Testing Service (ETS), the testing company that runs the state’s standardized exams, was breached, compromising the personal data of millions of students. We might think our child’s data isn’t valuable but it’s highly valuable to fraudsters and there are quick and easy things you can do to protect your child’s identity.
To provide guidance about how to protect your child’s identity before a data breach happens, I reached out to Ian Bednowitz, General Manager of LifeLock. Ian is a well-known expert in the identity protection space whose previous positions Bain & Company and eBay involved protecting consumers from identity theft and fraud.
How to Protect Your Child’s Identity Before a Data Breach Happens
Guest post by Ian Bednowitz, General Manager of LifeLock
About the California ETS Data Breach
Using a single compromised login, someone spent nearly four months copying files from a site ETS used to share test data with the state. The files cover enrolled over the past three school years, along with some records of former students going back to 2006. More than 5.7 million children attend California public schools this year alone.
If your child was one of them, you probably have questions. If your family lives somewhere else, you should have a few too.
That being said, the most common reaction I hear to exposure of children’s data is “my child doesn’t have anything to steal.” This is a misconception, as a child’s identity is highly valuable to a fraudster.
Why a Child’s Identity Is Worth Stealing
To an identity thief, a child is the perfect mark: no credit cards, no loans, no history and, best of all, no one checking. A stolen child’s identity can be used for years undetected.
Most families find out when their teenager applies for a first credit card or apartment and gets turned down. Javelin Strategy and Research reported roughly 1m cases of child identity theft in a year in their last study, and roughly 2% of all identity theft reports to the FTC have victims are minors.
The details in this breach add a second risk. An email that mentions your daughter’s special education services or your son’s lunch program will feel legitimate, because it knows things a stranger shouldn’t. That familiarity makes the scams that follow a breach so effective, and it’s why the coming weeks call for extra care.
What the Files Held
The stolen files read like the forms you fill out at the start of every school year: your child’s name, birth date, home address and state student ID number. For many students, the files also noted details families share with almost no one outside the school, including a disability, eligibility for free lunch, unstable housing, English learner status and test scores.
This information is like pieces of a puzzle that criminals put together over time until they have enough of an identity profile to victimize a child.
If You Live Somewhere Else
The weak point here was a vendor, and every school district in the country relies on them: testing services, homework apps, attendance software and cloud storage. Few parents know which companies hold their children’s records, and those companies answer to the schools that hire them.
Schools owe families a clear answer about which vendors hold student data, and they should require safeguards like multi-factor authentication before handing any of it over. Reports trace this breach to one compromised login, exactly the kind of attack multi-factor authentication exists to stop.
7 Things to Do to Protect Your Child’s Identity This Week
The good news: the most effective protection is free, and most of it fits into one afternoon, somewhere between homework and dinner.
1. Put your child’s credit on ice
This is the most important step. Equifax, Experian and TransUnion are required by federal law to let parents freeze the credit of a child under 16, free of charge. The bureau creates a file in your child’s name and locks it right away, so no one can open new accounts with it. Have your child’s birth certificate and Social Security card ready, along with proof of your own identity and address. Teens 16 and older can request their own.
2. Make sure there’s nothing to find
A child should have no credit file at all. If a bureau finds one, ask what’s in it right away.
3. Read the junk mail
A preapproved credit card offer addressed to your 10-year-old is a red flag, however flattering. So are collection calls or IRS notices in your child’s name, and a benefits application denied because someone already claimed your child.
4. Be skeptical of anyone who sounds like the school
In the coming weeks, expect emails, texts and calls that appear to come from your district, a testing company or a tutoring service. Never confirm personal details through a link or an incoming call. Call the school back at a number you already have.
5. Use your rights under FERPA
Federal law lets you opt out of releasing “directory information,” such as your child’s name, address and phone number. Ask your school for the form each fall, and ask which outside companies receive your child’s records.
6. Read the breach notice closely
If you received one, it explains what was exposed and any free protection being offered. In California, ETS is covering two years of Experian IdentityWorks; for children under 18, the enrollment deadline is March 19, 2027.
7. Act quickly if something looks wrong
If you find accounts you didn’t open, file a report at IdentityTheft.gov and with your local police.
Our kids will grow up with their personal information passing through hundreds of systems they’ll never see. We can’t control every one of them. We can make sure that when a breach like this one happens, a stolen name and birth date lead a thief nowhere. A credit freeze you set up this week may be something your child never knows about, and that’s exactly the goal.
Huge thanks to Ian Bednowitz, General Manager of LifeLock for sharing his expertise in this guest post. No compensation was received for this content.
The post How to Protect Your Child’s Identity Before a Data Breach Happens appeared first on Tech Savvy Mama.
