Identity
One stolen login, four months: the ETS student data breach
A stolen login on ETS's file transfer site exposed California student records for four months. What was taken and what to ask your own vendors.
Educational Testing Service (ETS), the nonprofit that runs California's statewide school tests, lost student records to an intruder who logged in with a stolen credential. The California Department of Education (CDE) announced the breach on October 16, and ETS began sending notices that day. They are expected to continue into early November.
The data came from an ETS secure file transfer protocol (SFTP) site that the state and ETS used to exchange assessment files. The intruder used it at various times between May 22 and September 18, 2026, and ETS only spotted the activity on September 25. Any organization that sends personal data to a vendor through a shared file drop should check the same controls on its own exchanges.
Who is affected and what was taken
According to the ETS notice, the copied files cover all students enrolled in California public schools in the three previous school years, and possibly more. Reporting by The Record and SecurityWeek adds students who left a California school as far back as 2006 without a confirmed transfer to another school.
There is no official count, and the two numbers in circulation measure different things. About 5.7 million is the number of students enrolled in California public schools in the 2025 to 2026 school year, which The Record, SecurityWeek and Malwarebytes cite as context. About 7 million is an estimate from the lawyers behind a proposed class action, reported by Government Technology. Neither is a confirmed breach total.
The records vary by student but may include:
- name, date of birth, home address, school, district and grade
- the Statewide Student Identifier (SSID) and local student ID
- gender, race or ethnicity, primary language, country of origin and English learner status
- disability and Section 504 status, testing accommodations and primary disability type
- eligibility for Title I, McKinney-Vento (homeless students) and Military Connected Student programs
- test registration, participation and results
The notice says Social Security numbers, driver's license and passport numbers, financial account and card data, passwords and parent or guardian details were not in the files. ETS says its web monitoring has found no sign the data has been published, and no group has claimed the attack.
How it happened
SFTP is file transfer over an SSH connection. A partner logs in with a username and either a password or a key, then uploads or downloads files. Many organizations run these sites as a drop box between themselves and a vendor, with one or a few service accounts per partner and files left in place until someone cleans them up.
ETS says an unauthorized party "used a compromised login credential" to access the site and copy files. Nothing published so far says how the credential was stolen, whether multi-factor authentication (MFA) was switched on for that account, or why repeated logins over four months did not raise an alert. Those gaps matter, and the CDE says it is reviewing ETS's compliance with its security and contract requirements.
What the timeline does show is that a single valid account was enough to read files holding years of student records, and that the account kept working from May 22 until at least September 18. On a well-watched transfer site, an account pulling far more files than its partner normally sends, or logging in from a new network, is the kind of event that gets flagged in days.
What ETS and the state have done
ETS disabled the account, took the SFTP site offline and brought in outside incident responders. It has built a new transfer site with what it calls enhanced security controls, and according to The Record and SecurityWeek it paused some testing work and normal enrollment data processing while its systems are checked. ETS is also offering two years of Experian IdentityWorks identity protection, with an enrollment deadline of March 19, 2027.
At least one proposed class action has been filed. The suit filed on October 20 by the firm Cotchett, Pitre & McCarthy, on behalf of two minors and a 2026 high school graduate, claims negligence, invasion of privacy and breach of contract, and asks for damages and court-ordered security improvements.
What to do
For parents and former students
- Read the notice on the CDE's ETS incident page at cde.ca.gov/ets and enroll before March 19, 2027. There is a minor product a parent enrolls, and an adult product for former students who are now 18 or older.
- Expect convincing scams. A message that names a child's school, grade, test results or disability status can now come from a stranger. Check anything about this incident against the CDE page instead of clicking links.
- Consider a credit freeze for a child. Birth date and home address are enough to start building a synthetic identity, and a child's file usually goes unchecked for years.
For school districts and anyone who sends data to vendors
Put these questions to every vendor that receives your records over SFTP or a managed file transfer (MFT) platform, and write the answers into the contract.
Authentication. Ask whether accounts use passwords, keys or both, and whether a second factor is required. On OpenSSH, AuthenticationMethods publickey,keyboard-interactive in sshd_config makes every login present a key and pass an interactive challenge such as a one-time code. Keys should be one per partner, rotated and revoked when staff leave.
Network limits. A partner exchange account should accept logins only from that partner's addresses. In OpenSSH, an AllowUsers entry such as partner@203.0.113.0/24 does this per account. Ask the vendor whether your account can be reached from anywhere on the internet.
File-level logging and review. Session logs are not enough. Running the SFTP subsystem as internal-sftp -l INFO makes OpenSSH log the file transactions it performs for each client, such as files opened and closed, which is what an investigator needs to say what left. Ask who reviews those logs and how often; daily review with alerts on a new source address or unusual download volume is a fair bar. Ask how long logs are kept, too. This intrusion ran for four months, so anything under a year leaves an investigator guessing.
Retention. A transfer site should hold files only until the other side collects them. Ask how long files stay after pickup, whether older years of data sit on the same server, and whether your own uploads include fields the vendor does not need. Removing the disability or program fields from an extract the vendor never uses shrinks the next breach.
Breach terms. Agree in the contract how fast the vendor must tell you, what logs they will hand over, and who pays for notification and monitoring.
Ask before the next file goes out
The CDE is now reviewing ETS against its contract, and most organizations would be in a similar position: depending on whatever the vendor chose to build. Our compliance and audit readiness work includes vendor security reviews of exactly these controls, and our security operations team can monitor file transfer logs alongside your own. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would run the work.
Sources: CDE news release, October 16, 2026, ETS Notice of Data Breach (CDE), The Record, SecurityWeek, Malwarebytes, Government Technology on the lawsuit, Open Class Actions, OpenSSH sshd_config manual, OpenSSH sftp-server manual.