Stolen login exposes California student records at ETS
A compromised credential let an intruder copy California student files from an ETS SFTP site between May and September 2026. Names, birth dates, addresses, and state IDs were exposed.
An unauthorized party used a single compromised login credential to access an Educational Testing Service (ETS) SFTP site and copy files containing California K–12 student records, the California Department of Education (CDE) has disclosed. ETS runs the state-mandated CAASPP and ELPAC testing programs under contract with CDE. The intruder reached the site repeatedly between May 22 and September 18, 2026, and ETS did not spot the activity until September 25. The primary source is CDE's incident page and its October 16 release.
What was exposed
Per the official notice, the copied records include name, date of birth, home address, school, district, grade, state and local student ID numbers (SSID), gender, race or ethnicity, primary language, country of origin, and English-learner status. Some records go further, adding disability and Section 504 status, testing accommodations, English-proficiency data, test registration and results, and Title I, McKinney-Vento, or military-connected designations.
CDE states the files did not include Social Security numbers, passwords, financial or payment-card data, or parent and guardian information.
Scope
No victim count has been published. CDE's own figures put California public-school enrollment above 5.7 million for 2025–26, and the affected population also reaches back to students who left a California school as far back as 2006 whose transfer was never confirmed with CDE. In other words, the exposed set is potentially large and includes people long out of the system.
The attacker is unattributed; no group has claimed the data, and ETS says its web monitoring has so far found no evidence it has been published.
What to do
For families and districts, the concrete steps are limited because no financial data or SSNs were taken, but the exposed identifiers still enable targeted fraud and phishing:
- Enroll affected students in the two years of free Experian IdentityWorks monitoring ETS is offering; notifications began October 16 and run into early November.
- Treat unsolicited contact referencing a child's school, grade, or test results as suspect — this breach gives a scammer exactly those details.
- Districts should review any other data-sharing SFTP endpoints for credential reuse, absent MFA, and missing egress monitoring — the vector here was a valid login, not a software flaw.
Context
The breach fits a run of incidents where the richest target is not the school district but the testing or records vendor it hands data to, and where the intrusion is a stolen credential rather than an exploit. ETS has taken the SFTP site offline, halted routine enrollment processing, and says it is building a replacement with stronger controls. The official disclosures still do not explain how the credential was compromised — the one detail that would tell other vendors whether they are exposed to the same path.