One Compromised Login Exposed Millions of California Students' Records

Single Stolen Credential Let Attackers Harvest Two Decades of California Student Data

The California Department of Education (CDE) has disclosed that an unauthorized party used a single compromised login credential to access a secure file transfer site operated by Educational Testing Service (ETS), the nonprofit contractor that administers California's statewide assessments, and copy files containing student information. ETS runs the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC) programs and relies on an SFTP (secure file transfer protocol) site to exchange assessment data with CDE. According to CDE's breach notice, the intruder accessed the site at various times between May 22, 2026 and September 18, 2026, but ETS did not detect the unauthorized activity until September 25, 2026 — more than four months after the first access. Information covering all students enrolled in California public schools over the prior three school years was accessed and copied, and the impacted population extends to former students who left a California school as far back as 2006. More than 5.7 million students were enrolled in California public schools in the 2025–2026 year alone, and media estimates put the total number of potentially affected current and former students at close to 7 million.

Incident Details

How It Worked

A Single Credential, Months of Undetected Access

CDE's investigation determined that the intrusion did not involve a software exploit, malware, or a vulnerability in ETS's SFTP platform itself. Instead, the attacker obtained one valid set of login credentials for an account with access to the transfer site and used it repeatedly over nearly four months to log in and copy files. Because the access used legitimate credentials rather than an obvious intrusion technique, the activity blended in with normal file-transfer traffic and went unnoticed until ETS identified anomalous activity on September 25 — by which point the attacker's last confirmed access had already occurred a week earlier, on September 18.

What Was Copied

The files taken from the SFTP site contained California student records tied to CAASPP and ELPAC testing and enrollment reporting. Per CDE's notice, the specific fields involved vary by individual but can include a student's name, date of birth, residential address, school, district, and grade level, their Statewide Student Identifier (SSID) and local student ID, demographic details such as gender, race or ethnicity, primary language, country of origin, and English learner status, disability and Section 504 status along with testing accommodations and primary disability type, and eligibility for federal programs including Title I Part A, Title I Part C, McKinney-Vento, and Military Connected Student status. CDE has stated that Social Security numbers, driver's license or passport numbers, financial account or payment card data, account passwords, and parent or guardian personal information were not part of the exposed files.

Containment and Response

Upon discovering the unauthorized activity, ETS disabled the compromised account, took the affected SFTP site offline entirely, and engaged external cybersecurity experts and law enforcement to investigate. The company has since stood up a replacement transfer site with stronger security controls, including additional multi-factor verification and tighter permission scoping. ETS also paused its standard enrollment-data processing and certain testing activities while it reviewed the security of its systems, an operational impact CDE flagged to county and district officials in an October 2 letter — two weeks before family notifications began. As of publication, ETS says ongoing monitoring has found no evidence that the stolen data has surfaced publicly.

Impact Assessment

Recommendations

For School Districts and State Education Agencies

• Inventory every third-party vendor and contractor with standing access to student data systems, and require evidence of multi-factor authentication and credential-rotation policies as a contract condition
• Request breach-notification SLAs and regular security attestations from testing and assessment vendors, rather than relying solely on post-incident disclosures
• Review data-minimization practices with vendors — assess whether decades-old former-student records need to remain accessible via active transfer systems at all

For ETS and Similar Education Technology Vendors

• Enforce mandatory multi-factor authentication on every account with SFTP or bulk data-transfer access, with no exceptions for service or shared accounts
• Deploy anomaly detection on file-transfer systems that flags unusual access patterns (off-hours logins, atypical file volumes, repeated access from new locations) rather than relying on manual discovery
• Apply least-privilege scoping so a single compromised credential cannot reach the full historical dataset, and segment current-year data from legacy archives
• Commission regular third-party security audits of systems that handle regulated student data, including control testing specific to PII and FERPA-covered information

For Affected Families and Students

• Enroll in the two years of free Experian IdentityWorks identity protection offered by ETS once notified
• Watch for phishing attempts that reference accurate personal details (name, school, grade) pulled from the breach, since this data can make scams more convincing
• Monitor for unexpected credit activity tied to a minor's identity, which can go unnoticed for years since children rarely check their own credit
• Read the official notice carefully (available in multiple languages) to confirm which specific data categories applied to your student

Key Takeaways

1. A single compromised login credential — not malware or a software exploit — gave an attacker roughly four months of access to ETS's SFTP site used for California student assessment data.
2. The breach affected close to 7 million current and former California public school students, with records for some former students dating back to 2006.
3. Exposed data included names, birth dates, addresses, student IDs, demographic details, disability and program-eligibility status, and assessment data — but not Social Security numbers, financial data, or passwords.
4. Detection lagged initial access by roughly four months (May 22 to September 25), underscoring how legitimate-looking credentialed access can evade routine monitoring.
5. ETS disabled the compromised account, took the SFTP site offline, rebuilt it with stronger controls including MFA, and is offering two years of free identity protection to affected individuals.
6. The incident is a reminder that state agencies' data security is only as strong as their vendors' — third-party and contractor access remains one of the least-monitored attack surfaces in the education sector.

Sources

• One Compromised Login Exposed Millions of California Students' Records — SecurityWeek
• Educational Testing Service (ETS) Incident — California Department of Education
• Millions of California student records breached, some dating back to 2006 — Cybernews