ETS Breach Exposes California Student Records
The California Department of Education (CDE) is warning students and families that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach. Attackers copied files from a secure file transfer (SFTP) site between May 22 and September 18, 2026. ETS discovered the breach on September 25, disabled the compromised account, took the site offline and built a new platform. No group has claimed responsibility.
Data Exposed
- Names, dates of birth, home addresses, schools, districts and grade levels
- Statewide and local student identifiers
- Gender, race or ethnicity, primary language, country of origin and English learner status
- Disability and Section 504 status, testing accommodations and primary disability type
- Eligibility for Title I, McKinney-Vento and Military Connected Student programs
- Statewide assessment registration, participation and results
Scope
More than 5.7 million students enrolled in California public K-12 schools in the 2025 school year are covered. Affected people include current and former students enrolled from 2023 onward, plus students who left a California school since 2006 without confirming a transfer to another school with CDE. ETS runs the CAASPP and ELPAC assessments.
Response
- Family notifications began October 16 and will continue through November.
- CDE is working with state cybersecurity experts and reviewing ETS's compliance with data security and contractual obligations.
- ETS says its web monitoring has found no evidence the data was published.
- ETS paused certain testing and halted normal enrollment data processing while it assesses its systems.
Takeaways
The attacker had access for nearly four months before detection, a reminder that vendor file-transfer sites need monitoring, credential rotation and tight access scoping. Families who receive a notice should watch for phishing that references school details and consider credit monitoring for older students.
Source: The Record.