The California Department of Education (CDE) announced on Friday, October 16, 2026, that an unauthorized party used one compromised login to copy files from a secure file transfer protocol (SFTP) site run by Educational Testing Service (ETS). The data covers millions of current and former California public school students. ETS is a New Jersey-based nonprofit that the state contracts to run its mandated assessments, including CAASPP (Smarter Balanced) and ELPAC. The breached party is ETS, the state's testing contractor. This is a separate incident from the Frontline Education K-12 vendor breach covered on 2026-10-14. According to CDE's notice, the attacker had intermittent access from May 22 to September 18, 2026, roughly four months, before ETS spotted the activity on September 25. Because the scope is statewide and covers every enrolled student, districts including LAUSD are affected. No exact record count has been published.
What Happened
- May 22 to September 18, 2026: CDE's breach notice says an unauthorized party "used a compromised login credential at various times" to get into the ETS SFTP site that ETS and CDE used to exchange statewide assessment data, and copied files containing student information (CDE notice; Reuters; Cybernews).
- September 25: ETS detected the activity. It disabled the account, took the SFTP site offline and brought in outside incident response firms (CDE notice).
- October 2: CDE sent a letter to county and district officials. Reuters reports the letter said ETS had halted "normal enrollment data processing." The Los Angeles Times reports that district leaders learned of the breach that day.
- October 16: Public disclosure. ETS, acting at CDE's direction, began mailing notices. CDE says notification will continue through early November.
ETS has since built an entirely new SFTP site with stronger controls (CDE press release). According to CDE, ETS has found no evidence so far that the data has been published, and it says it has "taken steps to reduce the potential risk of the data being made publicly accessible." That wording does not explain what those steps were, and it neither confirms nor rules out contact with the attacker. Law enforcement has been notified. No threat actor has been named, no group has claimed the attack, and no ransom demand has been reported.
What Was Taken
CDE says the data "varies by individual" but may include:
- Names, home addresses, dates of birth, grade level, and school and district
- Statewide Student Identifier (SSID) numbers
- Gender, race or ethnicity, primary language, country of origin and English learner status
- Disability information and eligibility for federal programs (LA Times; CDE)
- Statewide assessment data
Not involved, per CDE and ETS: Social Security numbers, financial account information, passwords, and parent or guardian information.
Scale: there is no exact figure yet, and the sources describe the scope differently. - Reuters quotes CDE as saying the data covers "all students enrolled in the three previous school years." It notes that 5.7 million students were enrolled in 2025-26 alone. - The LA Times says the number affected is "many more than" 5.7 million. It describes the scope as reaching back to 2023 enrollments, plus students who left California without a confirmed transfer, going back to 2006. - Cybernews and Golden Coast Trial Attorneys also cite 2006 as the earliest year. The law firm's description, "students enrolled as far back as 2006 who took state-mandated tests," is broader than the LA Times version, which limits the pre-2023 records to unconfirmed transfers. Treat the LA Times framing as the more precise one until CDE says otherwise.
ETS is offering two years of Experian IdentityWorks.
Why It Matters
- Long-lived data on minors. SSIDs, birth dates and addresses for children can be used for synthetic identity fraud for years before anyone notices. Disability status, English learner status and federal program eligibility are sensitive categories that cannot be reset like a password.
- One vendor holds data for a whole state. One credential on one file-exchange server exposed data covering every California district. Districts never ran or secured this system, but they still have to deal with parents and local fallout.
- A pattern in education technology. In 2026, Cyber Florida documented ShinyHunters' extortion campaign against Instructure's Canvas: abuse of account access, no malware, and 275 million records claimed across 8,809 institutions. UT's Regional SOC described the Mathspace breach (1,079,819 records) through an unpatched Metabase reporting tool, which ShinyHunters also claimed. Nothing in the sources links ETS to ShinyHunters or any other group. We cite those cases only to show that attackers are going after education vendors through their supporting infrastructure, not just their main applications.
- Slow detection. The access lasted about four months, and the attacker's last known session was a week before ETS noticed. That suggests login monitoring on the SFTP site was weak or missing.
The Attack Technique
Based on what has been disclosed, this was credential abuse, not exploitation of a software flaw:
- Initial access: valid account credentials (MITRE ATT&CK T1078) used against an internet-facing SFTP server.
- Collection and exfiltration: files were copied directly through the SFTP service over repeated sessions. Neither CDE nor ETS has reported malware or encryption.
- Unknown: how the credential was obtained (phishing, infostealer, reuse or a third party), whether the account had MFA, whether it belonged to a person or an automated process, and how much data left the server.
That the attacker logged in "at various times" over months fits a quiet, low-volume collection pattern. It does not fit a single smash-and-grab.
What Organizations Should Do
- Inventory every file-exchange endpoint (SFTP, MFT, shared drives) used with contractors and state agencies. Require MFA or key-based authentication tied to known source IPs, and delete dormant or shared service accounts.
- Alert on unusual SFTP behavior. That means logins from new ASNs or locations, sessions outside processing windows, and bulk downloads of directories an account doesn't usually touch.
- Delete files once the transfer is finished. Staging areas should not hold years of historical records. Here, data reaching back to 2006 was apparently still within reach.
- Add specific requirements to vendor contracts. These should cover MFA on all data-exchange paths, log retention, notification deadlines, and the right to audit. Write in the October 2 to October 16 gap between telling districts and telling the public, and decide whether that gap is acceptable.
- Check internal dashboards and BI tools (Metabase and similar) that query student records. Make sure they are patched, and when a critical advisory comes out, run the vendor's recommended compromise checks as well as the patch.
- Prepare districts and families for targeted phishing. Expect lures that impersonate ETS, CDE or Experian and use real student details. Publish one official channel for confirming notices.
Sources: Hackers steal personal data of millions of California students in m... | Educational Testing Service (ETS) Notification | California student data breach exposes millions of records Cybernews | Hacker gets data on millions of California students, state educatio... | ETS Data Security Incident - Year 2026 (CA Dept of Education) | Massive Data Breach Exposes Personal Information of Millions of Cal... | ShinyHunters Canvas Extortion Campaign | A missed advisory, a reporting tool, and 1,079,819 student and fami...