The use of compromised login credentials led to the theft of personal information belonging to current and former students in California public schools through the Educational Testing Service (ETS) file transfer system, according to an announcement by the California Department of Education (CDE).
ETS is a non-profit organization that administers state- and federal-mandated tests under official contracts, supporting the state's assessment programs (CAASPP and ELPAC) and relying on a Secure File Transfer Protocol (SFTP) site to share testing data with the Department of Education. The organization detected unusual activity on the site on September 25, while investigations indicated that the initial access dates back to late May.
The breach notification issued by the Department of Education stated that an unauthorized party used compromised login credentials at various times between May 22, 2026, and September 18, 2026, to access the SFTP server and copy files containing student data. Although an exact number of victims was not provided, the notification confirms that information regarding students enrolled in the past three academic years was fully accessed and copied, in addition to an impact extending to students who left California schools as far back as 2006 without official confirmation of their transfer.
What does the leaked data include?
The accessed records included various details such as student names, dates of birth, residential addresses, schools, districts and grade levels, local and state identification numbers, gender, race or ethnicity, primary language, country of origin, and English learner status. Some entries also included information on disability statuses and Section 504 classifications, testing accommodations, language proficiency data, test score and registration override data, as well as indicators of eligibility for various support programs.
Official authorities clarified that the leaked files did not contain Social Security numbers, passwords, financial details, or payment cards, nor did the breach compromise the data of parents and guardians.
Response and Technical Measures
Following the discovery, ETS disabled the account used in the breach and completely shut down the SFTP site, while beginning to build a replacement site equipped with stricter security controls. The organization worked with cybersecurity experts and law enforcement agencies to mitigate the risk of publishing the data on the internet, confirming that network monitoring has not yet detected any evidence of the data being leaked publicly.
Regarding notifications, the Department of Education notified school superintendents and district administrators on October 2, while the process of sending individual notices to affected students began on the 16th of the same month and is expected to continue until early November, coinciding with a temporary suspension of enrollment data processing and certain testing operations while system security is being evaluated.