Personal data on millions of current and former California public school students was copied from a file transfer server run by Educational Testing Service (ETS), the nonprofit contracted to deliver the state's standardized tests. The California Department of Education (CDE) and ETS confirmed the incident. ETS's breach notice was filed with the California Attorney General on October 16, 2026. According to the state, an intruder used a compromised login credential to copy files at various times between May 22 and September 18, 2026. ETS did not detect the activity until September 25. Neither CDE nor ETS has released a total count of affected people. The Los Angeles Times (via Slashdot) and Reuters (cited by Pasadena Now) both describe the number as "millions." No threat actor has been named, and ETS says it has so far found no sign that the data has been published.
What Happened
CDE's incident page says ETS identified unauthorized activity on September 25, 2026, on a secure file transfer protocol (SFTP) site it uses to exchange statewide assessment data with the department. ETS disabled the account involved, took the site offline and brought in outside cybersecurity specialists. Their investigation found that an unauthorized party had used a compromised credential to access the server and copy files repeatedly over almost four months, from May 22 to September 18. The last known access came seven days before detection.
CDE notified all California school districts on the evening of October 16, according to a letter Irvine Unified sent to families that night. ETS began mailing notification letters the same day, at CDE's direction. Districts including Irvine Unified and Pasadena Unified say their own systems were not involved. Law enforcement has been notified, and ETS says that did not delay its notice to families. ETS has also built a replacement SFTP site with what it calls stronger security controls.
A proposed class action, PL01 v. Educational Testing Service (No. 2:26-cv-12163), was filed on October 17 in the U.S. District Court for the Central District of California, according to OpenClassActions. The complaint's claims are unproven, and no class has been certified.
What Was Taken
Scope: Accounts of the scope match across sources but give no exact figure. - CDE says affected people include students enrolled in California public schools from 2023 through the current school year. ETS's notice describes this as "at a minimum" everyone enrolled in the past three school years. - Students who left a California school since 2006 without a confirmed transfer to another school are also included. - For context, California currently has about 5.7 million public school students (per the LA Times). Because former students are included, the affected group is larger than current enrollment, but no official total has been published.
Data types (these vary by individual, per CDE): - Name, date of birth, home address, school, district and grade level - Statewide Student Identifier (SSID) and local student ID - Gender, race or ethnicity, primary language, country of origin and English learner status - Disability and Section 504 status, testing accommodations and primary disability type - Eligibility for Title I Part A and Part C, McKinney-Vento (homeless students) and Military Connected Student programs - English proficiency data, plus state test registration, participation and results
Not included, according to CDE: Social Security numbers, driver's license and passport numbers, financial and card data, passwords, and any parent or guardian personal information.
Disability, homelessness and migrant program flags about minors are highly sensitive and cannot be "reset" the way a password can. Affected people are being offered 24 months of identity protection. Officials suggest parents consider credit freezes for children under 16.
Why It Matters
This is a supply-chain breach of a statewide data aggregation point. The ETS SFTP server held assessment data for the whole state, so one stolen credential exposed every district at once. Districts had no visibility into or control over that server.
The length of time the attacker had access is the key failure. Anton Dahbura of the Johns Hopkins Information Security Institute told the LA Times that "a stolen login credential should not become a months-long passport to millions of students' personal records." He questioned why authentication safeguards and access restrictions did not stop it. The class action complaint focuses on the same gap: ETS noticed the intrusion only a week after the last known download.
The broader education sector is under heavy credential-focused pressure. In a separate, unrelated campaign, BleepingComputer reported in September 2026 that an AI-agent-driven operation exploited PaperCut NG/MF flaws (CVE-2026-81578, CVE-2026-82078). That campaign compromised 395 organizations, about half of them in education, and harvested credentials from 280 victims. There is no evidence in the sources that it is connected to the ETS breach, and none of the sources claim a link. It does show how quickly stolen education-sector credentials are being gathered at scale. Also separately, Kern County Superintendent of Schools filed a notice with the California Attorney General on October 14 about a breach at its vendor Frontline Education, per cisonews.net. That is a different incident, and its notice discloses few details.
The Attack Technique
What is confirmed is narrow. A valid credential was compromised and then used to log in to an internet-facing SFTP server and copy files on multiple occasions over roughly four months. The official disclosures do not say: - how the credential was obtained (phishing, infostealer, reuse or vendor compromise) - whether the account had multi-factor authentication - whether it was a human or service account - why repeated bulk downloads went unnoticed
Detection on September 25 suggests ETS lacked behavioral alerting on file transfer volume or access patterns, or that alerts were missed. This is an inference and has not been confirmed. No ransom demand, extortion claim or leak site listing has been reported.
What Organizations Should Do
- Enforce MFA, or key-based authentication with IP allowlisting, on every SFTP and managed file transfer account. Pay particular attention to vendor and service accounts that move bulk data.
- Alert on file transfer anomalies. Flag unusual download volumes, off-hours sessions, new source IPs and repeated full-directory pulls. Four months of covert access means these signals were absent or ignored.
- Minimize what sits on transfer servers. Treat SFTP as a transit point, not storage. Delete files once they have been delivered, and keep data on students who left the system years ago off exchange infrastructure.
- Write audit and detection terms into vendor contracts. Require data processors to log access, retain logs, notify you within a set number of days of detection and run regular credential reviews.
- Hunt for exposed credentials. Check infostealer logs and breach corpora for vendor and staff accounts, and rotate any that turn up. The education sector is being actively targeted for credential harvesting.
- Prepare families for phishing that uses this data. Real names, schools and SSIDs make convincing lures. Publish the legitimate notification channels and encourage credit freezes for minors.
Sources: Personal Data for Millions of California Students Stolen in Massive... | AI-powered attack exploited PaperCut flaws to hack 395 organizations | Educational Testing Service (ETS) Incident | Statewide Data Breach Notification IUSD.org | PUSD Assessing Potential Local Impact of Statewide Student Testing... | ETS Data Breach Lawsuit Over California Student Records | Frontline Education Notifies Kern County Schools Community of Data... | ETS Breach Exposes California Student Test Records — Practical Tool...