The personal information of millions of current and former students in California has been compromised due to unauthorized access to a file transfer system managed by the Educational Testing Service (ETS), as reported by the California Department of Education (CDE). This breach has raised significant concerns over data security within educational institutions.
Details of the Data Breach
ETS, a nonprofit organization responsible for state and federal testing services, utilizes a secure file transfer protocol (SFTP) site to exchange testing data with the CDE. The breach was discovered on September 25, although unauthorized access began as early as late May. The breach notice from CDE revealed that an unauthorized entity used compromised login credentials repeatedly between May 22 and September 18, 2026, to access and copy files containing student information.
Extent of Compromised Data
The breach potentially affects over 5.7 million students who were enrolled in California public schools during the 2025-2026 academic year. Additionally, it includes students from as far back as 2006 whose records were not confirmed as transferred to other schools. The compromised data encompasses a wide range of personal information, such as names, birth dates, addresses, and educational details. Critical details like Social Security numbers and financial information were not involved, according to the notice.
Response and Security Measures
In response to the breach, ETS disabled the compromised account and took the SFTP site offline. The organization is developing a replacement site with enhanced security measures. Although the exact method of credential compromise remains undisclosed, ETS has collaborated with law enforcement and cybersecurity experts to mitigate the risk of public exposure of the data. So far, no evidence has surfaced indicating that the stolen data has been published online.
To address the incident, the CDE informed educational administrators via a letter on October 2, prior to notifying families. The notifications to the affected individuals began on October 16 and are expected to continue into early November. In an effort to protect those impacted, two years of free identity protection services are being offered to the affected students.
This incident underscores the critical need for robust cybersecurity protocols in educational institutions to safeguard sensitive data and prevent future breaches.
