The breached party is Educational Testing Service (ETS), not a school district. ETS is the Princeton, New Jersey-based nonprofit that runs California's statewide student assessments under contract with the state. An unauthorized party used a stolen login to copy files of California student data from an ETS-operated secure file transfer protocol (SFTP) site. The data includes names, addresses, dates of birth, demographics and disability records. The access happened at various times between May 22 and September 18, 2026. The California Department of Education (CDE) published the ETS breach notice on October 16. The LA Times reported that the affected population is well above the state's 5.7 million current public school students, because it covers students enrolled over the past three school years and some former students going back to 2006. Neither ETS nor CDE has published an exact count of affected people. Every account so far says only "millions."
What Happened
According to the notice CDE posted for ETS, ETS spotted unauthorized activity on its California assessment SFTP site on September 25, 2026. That site is used to exchange statewide testing data between ETS and CDE. ETS disabled the account involved, took the site offline and started an investigation with outside cybersecurity firms. The investigation found that the intruder had used a compromised credential repeatedly over roughly four months. The last access ended a week before anyone noticed. ETS says it has notified law enforcement.
The timeline as it stands:
- May 22 to September 18, 2026: Intermittent unauthorized access and copying of files (CDE/ETS notice, also reported by Cybernews and Class Action U)
- September 25: ETS detects the activity
- October 2: District leaders receive word, according to the LA Times
- October 16: CDE informs districts and the public. Notifications begin and are expected to run through early November (CDE press release)
Accounts differ on when districts were told. The LA Times, citing a letter from Deputy Superintendent Mary Nicely, says school district leaders heard on October 2. Irvine Unified's family letter, dated October 16, says CDE informed "all California school districts" that evening. One explanation is that some leaders got an early warning before the formal statewide notice, but no source confirms this.
CDE says ETS has since built an entirely new SFTP site with stronger security controls. CDE also says that after working with law enforcement and cybersecurity experts, ETS has "taken steps to reduce the potential risk of the data being made publicly accessible." Neither organization has explained what those steps were. ETS says its web monitoring has not yet found the data published anywhere.
What Was Taken
The CDE notice, the IUSD letter and secondary coverage (LA Times, Cybernews, CaliToday) all list the same fields. What was exposed varies by student, but may include:
- Identity: name, date of birth, home address, school, district, grade level
- Identifiers: Statewide Student Identifier (SSID) and local student ID
- Demographics: gender, race or ethnicity, primary language, country of origin, English learner status
- Disability data: disability and Section 504 status, testing accommodations, primary disability type
- Program eligibility: Title I Part A, Title I Part C (migrant education), McKinney-Vento (homeless students) and Military Connected Student status
- Assessment data: CAASPP and ELPAC registration, participation, results and English proficiency information
Not involved, per ETS/CDE: Social Security numbers, driver's license and passport numbers, financial account and card data, passwords, and parent or guardian information.
Scope: CDE and Cybernews describe the affected group as all students enrolled in California public schools over the past three school years, plus some former students dating back to 2006. The LA Times explains the 2006 group as students who left California without a confirmed transfer to another school. No primary source has given a total. Treat any specific figure circulating online as unverified.
ETS is offering two years of free Experian IdentityWorks identity protection.
Why It Matters
This dataset does little for financial fraud and a lot for targeting. It combines minors' names, addresses and birth dates with disability diagnoses, homelessness status, migrant-program eligibility, country of origin and military-family status. Those fields identify the most vulnerable students in the state. They are useful for social engineering, synthetic identity fraud that starts years before a child ever checks their credit, and harassment of specific groups. Irvine Unified felt it necessary to tell families that districts "do not track or maintain records regarding immigration status," which shows how sensitive the country-of-origin field is.
The structural point for defenders is concentration risk. Districts did nothing wrong here. IUSD stressed its own systems were not breached. A single state-contracted vendor held records for every district, and one compromised login exposed all of them. The same pattern appeared in a separate, unrelated incident earlier this year. The UT Regional Security Operations Center documented the Mathspace breach, which affected 1,079,819 students, parents and staff in Australia and New Zealand. In that case attackers got in through an unpatched internal Metabase reporting tool rather than the main application, in a campaign claimed by ShinyHunters. No source links ShinyHunters or anyone else to the ETS incident. The shared lesson is that ed-tech data pipelines and back-office tools often hold the full dataset with less protection than the front door.
No threat actor has claimed the ETS breach, and none has been named.
The Attack Technique
Based on the official notice, this was credential-based access to an internet-facing file transfer service. No exploit or malware has been reported.
- Initial access: a valid, compromised login credential for the ETS SFTP site (MITRE ATT&CK T1078, Valid Accounts). ETS has not said how the credential was obtained. Phishing, infostealer malware, reuse of a leaked password, or a credential belonging to a partner account are all possible, and none is confirmed.
- Collection and exfiltration: files were copied directly from the SFTP site over several sessions spanning about four months.
- Detection gap: roughly 17 weeks of intermittent access went unnoticed, and detection came a week after the last known session. This suggests the logins looked enough like normal account use not to raise alerts, or that file-transfer logs were not being actively monitored.
Nothing in the sources says whether the account was protected by multi-factor authentication. It is also unknown whether the site held a growing archive of historical files rather than only transient transfers. The 2006 records point toward an archive.
What Organizations Should Do
- Get bulk data off SFTP. Treat file transfer servers as data stores, not pipes. Delete files once the transfer is confirmed, set retention limits, and question why records from decades ago sit on an internet-facing exchange point.
- Enforce strong authentication on every file transfer account. Require SSH key or certificate authentication tied to specific hosts, restrict source IPs to known partner ranges, and rotate credentials on a schedule. Shared or long-lived passwords on SFTP accounts are a known path to exactly this outcome.
- Baseline and alert on transfer behavior. Log every SFTP session and file download, and alert on new source IPs, off-hours access, and download volumes above an account's normal pattern. Four months of intermittent copying should produce a detectable signal.
- Audit vendor data minimization in contracts. State agencies and districts should require contractors to justify every field they hold, especially disability, homelessness and migrant status. Contracts should also set breach notification deadlines measured in days and give the agency the right to audit vendor access controls.
- Inventory the "side doors." As both this incident and the Mathspace breach show, exposure often comes from transfer sites, reporting dashboards and BI tools with live data connections. Patch them on the same schedule as production systems, and run the vendor's recommended compromise checks after patching.
- Prepare affected-family guidance. Districts should tell families that a child's credit can be frozen. Since parent data was not involved, any message claiming to be from ETS, CDE or a school that asks for SSNs or payment should be treated as phishing.
Sources: Hackers steal personal data of millions of California students in m... | Educational Testing Service (ETS) Notification | ETS Data Security Incident - Year 2026 (CA Dept of Education) | Statewide Data Breach Notification IUSD.org | California student data breach exposes millions of records Cybernews | Educational Testing Service Data Breach Lawsuit | A missed advisory, a reporting tool, and 1,079,819 student and fami... | Tin tặc đánh cắp dữ liệu cá nhân của hàng triệu học sinh California...