Compromised credential exposes California student records via ETS SFTP site, affecting millions
An unauthorized party used a compromised login credential to access a file transfer (SFTP) site belonging to Educational Testing Service (ETS) and copy files containing California public school student data, according to the California Department of Education (CDE). ETS supports the state's CAASPP and ELPAC assessment programs. Access occurred between May 22 and September 18, 2026, and ETS spotted the activity on September 25. No victim count has been given, but the notice says all students enrolled in the three previous school years were affected, and the population extends back to students who left California schools as early as 2006. The attacker has not been identified and the source of the credential compromise has not been disclosed.
Technical Details
- Initial access was a compromised login credential used at various times to access the ETS SFTP site and copy files.
- Exposed data can include name, birth date, home address, school, district, grade, state and local ID numbers, gender, race or ethnicity, primary language, country of origin and English learner status.
- Some records also include disability and Section 504 status, disability type, testing accommodations, English proficiency data, test registration and results, and Title I, McKinney-Vento or military-connected designations.
- The files reportedly did not contain Social Security numbers, passwords, financial account or payment card data, or parent and guardian information.
- ETS web monitoring has so far found no evidence that the data has been published.
Remediation
- ETS disabled the compromised account, took the SFTP site offline and is building a replacement with stronger safeguards.
- ETS worked with law enforcement and cybersecurity experts to reduce the risk of the data becoming public.
- Student notifications began October 16 and are expected to continue into early November. Affected current and former students are offered two years of free identity protection services.
Linha do tempo
-
Compromised credential exposes California student records via ETS SFTP site, affecting millions
ler a análise desta fonte ocultar
An unauthorized party used a compromised login credential to access a file transfer (SFTP) site belonging to Educational Testing Service (ETS) and copy files containing California public school student data, according to the California Department of Education (CDE). ETS supports the state's CAASPP and ELPAC assessment programs. Access occurred between May 22 and September 18, 2026, and ETS spotted the activity on September 25. No victim count has been given, but the notice says all students enrolled in the three previous school years were affected, and the population extends back to students who left California schools as early as 2006. The attacker has not been identified and the source of the credential compromise has not been disclosed.
Technical Details
- Initial access was a compromised login credential used at various times to access the ETS SFTP site and copy files.
- Exposed data can include name, birth date, home address, school, district, grade, state and local ID numbers, gender, race or ethnicity, primary language, country of origin and English learner status.
- Some records also include disability and Section 504 status, disability type, testing accommodations, English proficiency data, test registration and results, and Title I, McKinney-Vento or military-connected designations.
- The files reportedly did not contain Social Security numbers, passwords, financial account or payment card data, or parent and guardian information.
- ETS web monitoring has so far found no evidence that the data has been published.
Remediation
- ETS disabled the compromised account, took the SFTP site offline and is building a replacement with stronger safeguards.
- ETS worked with law enforcement and cybersecurity experts to reduce the risk of the data becoming public.
- Student notifications began October 16 and are expected to continue into early November. Affected current and former students are offered two years of free identity protection services.