Educational Testing Service (ETS) runs California's statewide student assessments. An unauthorized party used one compromised login to access an ETS secure file transfer protocol (SFTP) site and copy files of California student data. They did this at various times between May 22 and September 18, 2026. The California Department of Education (CDE) and ETS confirmed the breach in a formal Notice of Data Breach and a press release. Neither has published an exact victim count. CDE says the affected data covers "including but not limited to all students enrolled in the three previous school years," and also some students going back to 2006. For scale, SecurityWeek, The Record and CBS San Francisco each cite CDE's figure of more than 5.7 million students enrolled in 2025-26. That is enrollment for a single year, not a confirmed count of affected records. Across three years plus older records, the real total is probably higher, but no source gives a number.
What Happened
ETS spotted unauthorized activity on September 25, 2026, on an SFTP site it used to exchange statewide assessment data with CDE. According to the breach notice, ETS:
- disabled the account involved
- took the SFTP site offline
- brought in outside cybersecurity experts to investigate
CDE says ETS has since built "an entirely new SFTP site with enhanced security controls." The notice says law enforcement was informed.
The intruders stayed undetected for about four months, from first access in May to discovery in late September. The last recorded access, on September 18, came a week before ETS noticed anything. Notifications began going out on October 16 and are expected to continue through early November, per CDE.
ETS says routine web monitoring has so far found no sign that the data has been published. CDE says ETS has "taken steps to reduce the potential risk of the data being made publicly accessible," but does not say what those steps are. No threat actor has been named or has claimed the attack. The Record reports that ETS did not respond to requests for comment.
What Was Taken
The fields vary by student. CDE's notice, repeated by the San Francisco Unified School District (SFUSD), The Record and SecurityWeek, lists:
- Identity: name, date of birth, home address, school, district, grade level, Statewide Student Identifier (SSID) and local student ID
- Demographics: gender, race or ethnicity, primary language, country of origin, English learner status
- Disability: disability and Section 504 status, primary disability type, testing accommodations
- Program eligibility: Title I Part A, Title I Part C (migrant education), McKinney-Vento (homeless students), Military Connected Student
- Assessment data: English proficiency information, plus CAASPP/ELPAC registration, participation and results
The following were not involved, according to CDE and SFUSD:
- Social Security numbers
- driver's license or passport numbers
- financial or card data
- passwords
- parent or guardian information
Who is affected:
- current and former students enrolled from 2023 through the current school year
- students who left a California school as far back as 2006 without a confirmed transfer
SFUSD says the exposure covers enrolled students "regardless of whether they were tested or not." ETS is offering two years of Experian IdentityWorks. Dry Creek Joint Elementary School District gives the enrollment deadline as March 19, 2027.
Why It Matters
There is no financial data here, but the data is still highly sensitive. It ties minors to disability diagnoses, homelessness status, migrant status, military family status and country of origin. None of that can be changed or reissued the way a password or card number can. Combined with home addresses and dates of birth, it makes convincing phishing and impersonation aimed at families straightforward. Child identity fraud is also a long-term risk, because it often goes unnoticed for years.
The breach also shows how vendor concentration creates a single point of failure. Districts such as SFUSD and Dry Creek stress that their own systems were not involved. Dry Creek says it has not even received a list of affected students. A single contractor held data for the whole state, and one credential on one file-transfer endpoint was enough to reach all of it.
The Attack Technique
All sources agree on the method. The attacker used a valid, compromised login against an internet-facing SFTP service and copied files over several sessions. No exploit or malware has been reported. None of the sources say:
- how the credential was obtained (phishing, infostealer, reuse or a leaked key)
- whether it belonged to a person or a service account
- whether multi-factor authentication or IP restrictions were in place
Repeated bulk downloads over four months went undetected. That points to weak monitoring of file-transfer activity, not to a sophisticated intrusion.
What Organizations Should Do
- Harden file-transfer endpoints. Require MFA or key-based authentication tied to restricted source IPs on SFTP and MFT systems. Remove password-only accounts.
- Audit and rotate transfer credentials. List every account, human or service, on data-exchange systems. Rotate credentials regularly and disable any that are dormant or shared.
- Alert on abnormal downloads. Baseline normal volumes, times and source addresses for each account. Long-running exfiltration through valid credentials should not go unnoticed for months.
- Minimize retained data. Data on students who left as far back as 2006 was still on an active exchange site. Set retention limits and purge transferred files once their purpose is served.
- Put security terms in vendor contracts. Require MFA, logging, timelines for notifying you of breaches, and the right to audit from any contractor holding student PII. Know which fields each vendor actually needs.
- Prepare families for targeted phishing. Warn parents that scammers may use accurate school and student details. Point them only to official CDE and ETS contact channels.
Sources: One Stolen Login Exposed Millions of Student Records | California warns all public school students of data stolen in contr... | One Compromised Login Exposed Millions of California Students' Reco... | Educational Testing Service (ETS) Notification | ETS Data Security Incident - Year 2026 (CA Dept of Education) | California state testing data breach may impact millions of student... | ETS Data Security Incident May Affect SFUSD Students and Families... | Important Information- Statewide Data Security Breach Post Details