A compromised login gave an unauthorized party months of access to a file-transfer site used to share California's statewide testing data. The files copied include student names, birth dates, home addresses, and disability and program details.
Educational Testing Service (ETS), the nonprofit that runs California's state-mandated student assessments, has started notifying families after an intruder copied student records from one of its systems. The California Department of Education (CDE) announced the incident on October 16, 2026. Notification letters began going out the same day and are expected to continue into early November.
What happened
ETS runs California's CAASPP and ELPAC testing programs under contract with the state. It used a secure file transfer protocol (SFTP) site to exchange assessment data with CDE.
According to the official breach notice, ETS spotted unauthorized activity on that SFTP site on September 25, 2026. Its investigation found that someone had used a compromised login credential at various times between May 22 and September 18, 2026 to copy files with California student information. That means the intruder had about four months of on-and-off access before anyone noticed.
ETS disabled the account, took the site offline and built a new SFTP site with stronger security controls. Neither ETS nor CDE has said how the credential was compromised or who was behind the intrusion. ETS says its web monitoring has not found the data published anywhere so far.
What data was exposed
The details vary from student to student, but the notice says the copied files may include:
- Student name, date of birth, home address, school, district and grade level
- Statewide Student Identifier (SSID) and local student ID
- Gender, race or ethnicity, primary language, country of origin and English learner status
- Disability and Section 504 status, primary disability type and testing accommodations
- Eligibility for programs such as Title I, McKinney-Vento and Military Connected Student
- English proficiency data and statewide test registration, participation and results
ETS says the files did not contain Social Security numbers, driver's license or passport numbers, financial account or card details, or passwords. Parent and guardian information was also not involved.
Who is affected
The notice says the copied data covers, "including but not limited to," every student enrolled in a California public school in the past three school years. Politico, citing CDE, reported that about 7 million students are affected. The official notice does not give an exact number. CDE's own figures show more than 5.7 million students were enrolled in 2025-26 alone. According to CDE's incident FAQ, as reported by SecurityWeek, some former students who left a California school as far back as 2006 are also included.
What to do now
- Enroll in the free protection. ETS is offering affected current and former students two years of Experian IdentityWorks at no cost. Enrollment steps for minors and adults are in the official notice on the CDE website.
- Consider a credit freeze for your child. Children rarely need credit, so a freeze with the major credit bureaus is a simple way to block fraudulent accounts opened in their name.
- Watch for targeted phishing. Names, addresses, schools and disability details make scam messages very convincing. Be wary of emails, texts or calls that mention the breach, a school or special education services, especially if they ask for payment, Social Security numbers or login details.
- Verify through official channels. Check any breach letter against the notice posted by CDE rather than following links in messages you didn't expect.
This incident is another reminder that sensitive data is often only as safe as the vendors holding it. One stolen password, with no alert raised for months, was enough to expose records on millions of children.
Sources
- California Department of Education: https://www.cde.ca.gov/nr/ne/yr26/yr26rel45.asp
- ETS Notice of Data Breach (CDE, PDF): https://www.cde.ca.gov/nr/in/documents/etsdatabreach-english.pdf
- SecurityWeek: https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/
- Politico: https://www.politico.com/news/2026/10/16/hack-exposes-data-on-millions-of-california-students-01124018
0 Comments