An intruder using a single stolen login copied files on California public school students from a state testing contractor's file-transfer site for nearly four months, according to a breach notice the contractor, Educational Testing Service, issued at the direction of the California Department of Education and that was filed with the state attorney general. Reuters reported the breach Friday. The case shows how much sensitive data on children can sit with one vendor, and how long a single compromised credential can go unnoticed.
What Happened
ETS, a nonprofit that runs state and federally required testing in California public schools under a state contract, said in its "Notice of Data Breach" that it spotted unauthorized activity Sept. 25 on an SFTP site (a secure file transfer protocol server, used to move files between organizations) that it uses to exchange statewide assessment data with the department.
Its investigation found that an unauthorized party used a compromised login credential at various times between May 22 and Sept. 18 to copy files containing student information. The attorney general's breach listing records the filer as "CDE" and the breach date as May 22.
The notice does not give a total. It says the affected group includes, "but not limited to," every student enrolled in the three previous school years. Reuters reported that more than 5.7 million students were enrolled in California in 2025-26. Politico reported that the department put the exposure at about 7 million students enrolled over the past three school years; that figure does not appear in the notice. The Los Angeles Times reported that former students are also affected, including some whose records date to 2006.
According to the notice, the copied data may include student name, date of birth, home address, school, district and grade; state and local student ID numbers; gender, race or ethnicity, primary language, country of origin and English learner status; disability and Section 504 status, testing accommodations and primary disability type; eligibility for Title I Part A, Title I Part C, McKinney-Vento and military-connected student programs; and English proficiency and state test registration, participation and results.
The notice says the files did not include Social Security, driver's license or passport numbers, financial account or card data, or account passwords, and no parent or guardian information was involved.
ETS said it disabled the account, took the site offline, built a new one with stronger controls and brought in outside cybersecurity experts. It said it has found no evidence so far that the data has been made public. No source has named an attacker or reported a ransom demand. ETS spokesperson Christine Betaneli told the Los Angeles Times that no other ETS customers were affected.
Why It Matters
Several of these fields go well beyond a typical breach. Section 504 refers to a federal disability-rights provision that entitles students to classroom accommodations. McKinney-Vento is the federal program for homeless students, Title I Part C serves children of migrant workers, and the military-connected flag marks children of service members. Together with disability type and home address, those labels describe a child's health, housing and family circumstances, and that kind of information cannot be reissued the way a card number can.
For boards and agency heads, the core issue is third-party risk. A routine data feed to a testing vendor became a single point of failure, protected by one credential, and the copying went undetected from late May until late September. The state is now reviewing ETS's compliance with "applicable data security and contractual requirements," the notice says. That review could shape how public bodies write and enforce security terms for contractors handling regulated data.
The disruption is operational as well. An Oct. 2 department letter to county and district superintendents said ETS had halted normal enrollment data processing and paused certain testing activities.
What to Watch
- Findings from the department and State Board of Education review of ETS, supported by the California Cybersecurity Integration Center, the Department of Technology and the Governor's Office of Emergency Services.
- When enrollment processing and paused testing activities resume.
- Any sign the data surfaces publicly, or any claim of responsibility or ransom demand.
- Whether ETS's statement that no other customers were affected holds up.
- Enrollment in two years of free Experian IdentityWorks protection, which closes March 19, 2027.
The breach follows a separate incident at K-12 software vendor Frontline Education, which exposed data on school district staff.
