Educational Testing Service (ETS), the Princeton-based non-profit that runs California's statewide K-12 assessments, has begun notifying students and families of a breach. An unauthorized party used a compromised login credential to copy student files from an ETS-operated SFTP site over a period of almost four months. The California Department of Education (CDE) published the notice and says notifications began on October 16 and will continue into early November. POLITICO, citing CDE, reports that the exposed data covers all 7 million students enrolled in California public schools over the past three school years. The CDE notice and press release excerpts available for this brief do not give a total count. Separately, the Everest ransomware group listed "ETS" on its leak site on September 25, the same day ETS says it detected the intrusion. No official statement connects that claim to the student data breach.
What Happened
The ETS Notice of Data Breach, distributed by CDE, gives this timeline:
- May 22 to September 18, 2026: An unauthorized party used a compromised credential "at various times" to log into the SFTP site that ETS and CDE use to exchange California statewide assessment data, and copied files containing student information.
- September 25, 2026: ETS identified the unauthorized activity, disabled the account involved, took the SFTP site offline, and brought in outside cybersecurity experts.
- After discovery: ETS says it built "an entirely new SFTP site with enhanced security controls." It also says it worked with law enforcement and security experts to "reduce the potential risk of the data being made publicly accessible."
- October 16, 2026: Notifications to students and families began.
CDE says ETS's web monitoring has so far found no evidence that the data has been published. Law enforcement has been notified, and the notice states that investigations did not delay it.
Accounts differ on how this connects to Everest. Two ransomware-tracking sites, Cyber Threat Intelligence and HookPhish, record Everest listing a victim named "ETS" on September 25, 2026. HookPhish's own automated summary admits that "ETS" is too generic to tie to a specific organization. A federal class action filed October 5 in the District of New Jersey by former ETS online score reader Patricia Chivers names Educational Testing Service as the Everest victim and alleges that employee records were compromised. Those records allegedly include Social Security numbers, driver's license details, and banking information. The ETS and CDE notices do not mention ransomware, Everest, or employee data. Based on these sources, we cannot confirm whether the leak-site listing, the employee-data allegations, and the student SFTP breach are one incident or several. The September 25 date overlap is notable but does not prove a link.
What Was Taken
According to CDE, the data varies by individual but may include:
- Student names and Statewide Student Identifiers (SSIDs)
- Dates of birth and home addresses
- Demographic information
- Disability and program participation information
- Statewide assessment information (CAASPP and ELPAC)
CDE says Social Security numbers, financial account information, passwords, and parent or guardian information were not involved. ETS is offering affected current and former students two years of Experian IdentityWorks.
Scale: POLITICO, citing CDE, puts the total at about 7 million students, meaning every student enrolled in California public schools over three school years. Jingletree repeats this figure, attributing it to POLITICO. We have not seen it stated in the official notice text available to us, so treat it as CDE's reported figure until the full notice or a regulator filing confirms it.
The Chivers lawsuit makes separate claims about employee PII and financial data. These are unproven allegations in a complaint, not confirmed breach findings.
Why It Matters
- Minors' data lasts. A child's name, date of birth, and address can be used for synthetic identity and credit fraud for years before anyone notices. Disability and special-program flags are sensitive data that cannot be changed or reissued.
- The weak point was a vendor. CDE's systems were not breached. A contractor's file-exchange server holding statewide data was. One credential protecting one SFTP account was enough to expose a whole state's student population.
- Nobody noticed for four months. The attacker came back repeatedly between May and September without being caught. The problem was not one bad login. Nobody was watching logins or data leaving the server.
- Possible extortion. If the Everest listing does refer to this ETS, the stolen data may be used as leverage for payment. That would make ETS's statement about reducing the risk of publication especially important.
The Attack Technique
ETS and CDE describe the method as use of a compromised login credential (valid accounts) against an internet-facing SFTP service, followed by repeated file copying. They have not said how the credential was obtained (phishing, infostealer malware, reuse of a password leaked elsewhere, or a shared or service account). They also have not said whether multi-factor authentication or IP allowlisting was in place. ETS's replacement of the whole site, rather than a simple password reset, suggests the old setup lacked controls.
Cyber Threat Intelligence lists general Everest tradecraft, including obfuscated files (T1027) and registry modification (T1112). That is a profile of the group, not evidence from this intrusion, and nothing in the ETS disclosure suggests malware ran on endpoints. The CAASPP/ELPAC test security guidance we reviewed covers procedures for staff who handle test materials, not the SFTP data-exchange system involved here.
What Organizations Should Do
- List every SFTP and managed file transfer (MFT) endpoint, including ones run by vendors on your behalf. Require phishing-resistant MFA, or key-based authentication plus IP allowlisting, on every account. Retire shared and stale credentials.
- Write vendor contracts that set controls for bulk data exchange: MFA, log retention, alerting, breach-notification deadlines, and the right to audit, scaled to how sensitive the data is.
- Alert on unusual logins and data volume. Watch for logins from new IPs or ASNs, logins at odd hours, and download volumes far above the normal transfer pattern. Four months of repeated access should be caught.
- Keep less data on transfer servers. Delete files after they are retrieved, encrypt files at rest with keys stored separately, and do not leave years of historical data sitting on an exchange server.
- Watch for leaked credentials. Check infostealer logs and breach-data feeds for vendor and staff accounts that can reach sensitive systems, and rotate any that turn up.
- Schools and families: Enroll in the offered identity protection and think about freezing children's credit. Expect phishing that uses real student details such as SSID, school, or test history to look legitimate.
Sources: Hack exposes data on millions of California students - POLITICO | Educational Testing Service (ETS) Notification | ETS Data Security Incident - Year 2026 (CA Dept of Education) | Test Security | Former employee sues Educational Testing Service over alleged failu... | ETS Ransomware Attack by Everest (2026) Cyber Threat Intelligence | Hackers steal sensitive personal info from millions of California s... | Ransomware Group everest Hits: ETS