A data breach at Educational Testing Service (ETS), a contractor for the California Department of Education, affects students enrolled in the state for the past three years. The copied files contain highly detailed school and personal information, while the organization is just beginning to notify families after several months of unauthorized access.
Compromised account opened access for four months
On September 25, 2026, ETS detected abnormal activity on an SFTP server, a secure space used to exchange school assessment data with the California Department of Education (CDE). The investigation then established that a third party used a compromised identifier on several occasions between May 22 and September 18. The attacker didn’t just query the server: he copied files.
The scope is considerable. The CDE indicates that among the information exposed is the data of all students enrolled during the previous three school years. California had more than 5.7 million students in the 2025-2026 year alone, but the authority has not yet provided a definitive total of those affected. These are, therefore, several million files, with a level of detail that varies according to each student.
Records may include name, date of birth, address, school, district, grade level, and administrative identifiers. They also include, depending on the case, gender, declared origin, main language, country of origin, evaluation results, English learning status and participation in different programs. Information regarding disabilities, exam preparation, or the situation of certain students without a stable home may also have been copied.
This academic and social nature distinguishes the incident from a classic coordinate theft. Even without banking data, gathering durable intelligence can facilitate credible phishing attempts targeting families. We recently saw with the CAF leak that administrative bases become especially sensitive when they allow a fraudulent message to be contextualized.
No passwords or social security numbers
The notification document states an important limitation: The copied files did not contain social security numbers, driver’s licenses, passports, payment cards, financial accounts or passwords. The personal information of parents and guardians is also not affected. This reduces the risk of immediate financial fraud, without eliminating the risk of identity theft or social engineering around school and exams.
ETS says it has found no evidence at this stage of publishing the data. However, this wording does not guarantee either its destruction or the absence of private circulation. The organization deactivated the account involved, took the affected server offline, and created a new SFTP space with improved controls. California’s Cal-CSIC participates in the forensic analysis, along with the state’s Department of Technology and the Office of Emergency Services.
The incident illustrates a common weakness of the digital public chain: the administration can impose its own security standards, but data also passes through subcontractors. ETS notably administers the CAASPP and ELPAC assessments, requiring it to centralize information from many school districts. A single compromised identity thus gave access to a whole much greater than the account of an isolated establishment.
Notifications until early November
Notification to families began on October 16 and is expected to continue through early November. The CDE specifies that the competent police authorities have been notified. At the same time, it examines ETS’s compliance with its contractual and security obligations, a separate aspect of the search for the perpetrator of the intrusion.
Affected current and former students can receive two years of identity monitoring from Experian IdentityWorks for free. Two options are offered, one for minors and another for people who are now of legal age. Registration must be completed no later than March 19, 2027 and does not require a credit card, a useful detail since fake support sites could exploit precisely the leak announcement.
