One Compromised Login Exposed Millions of California Students’ Records

This incident involved unauthorized access to an ETS SFTP server using compromised login credentials. The attackers accessed and copied files containing detailed information on California public school students, including those currently enrolled and former students dating back to 2006. The data set includes personally identifiable information and sensitive educational details but does not contain Social Security numbers or financial data. The breach was active from late May through mid-September 2026 before detection. ETS responded by disabling the compromised account, taking the site offline, and initiating development of a more secure replacement system. Law enforcement and cybersecurity experts were engaged, and no evidence of public data disclosure has been found to date. Notifications and free identity protection services are being offered to affected students.

The breach exposed personal and sensitive educational information of millions of California public school students, including current and former students over a 20-year span. While Social Security numbers and financial data were not compromised, the exposed data could facilitate identity theft, privacy violations, and targeted phishing or social engineering attacks. The scale of the breach is significant given California's large student population, potentially affecting over 5.7 million students. The incident also disrupted ETS operations, including suspension of enrollment data processing and some testing activities.

ETS disabled the compromised login credential and took the affected SFTP site offline. They are building a replacement system with enhanced security measures. Law enforcement and cybersecurity experts have been involved in the response. Affected individuals are being notified and offered two years of free identity protection services. No further action is currently recommended by ETS, and no evidence of public data disclosure has been found. Organizations should monitor for any suspicious activity related to the exposed data and follow guidance from ETS and CDE as it becomes available.