ETS Breach Exposes California Student Records Dating Back to 2006

Intruders used stolen credentials to copy millions of student records from an Educational Testing Service file transfer server, according to the California Department of Education. The nonprofit testing organization handles state-mandated exams under contract with California and relies on a secure file transfer protocol site to share data with the department.

The California Department of Education confirmed that unauthorized parties accessed the system to copy files containing sensitive student information. ETS detected the unauthorized activity on September 25, 2026, but the investigation revealed that the attackers had been accessing the site since late May. The breach notice states that the intruders used a compromised login credential to enter the SFTP site repeatedly between May 22 and September 18, 2026.

Scope of the Data Breach

The incident affects a vast number of individuals, including all students enrolled in California public schools during the three previous school years. Department enrollment figures indicate that more than 5.7 million students were enrolled in the 2025-2026 academic year. The impacted population also includes former students who left a California school as far back as 2006, provided their transfer to another school was not confirmed with the department.

Compromised records contain detailed personal and academic information, including student names, birth dates, home addresses, and school districts. The data also reveals grade levels, state and local ID numbers, gender, race, ethnicity, and primary language. Additionally, the files include country of origin, English learner status, and disability information such as Section 504 status and primary disability type.

Response and Mitigation

The stolen files further disclose testing accommodations, English proficiency data, and test registration and results. Some entries indicate whether a student qualifies for Title I, McKinney-Vento, or military-connected student designations. However, the breach notice explicitly states that the files did not contain Social Security numbers, passwords, or financial account details. Information regarding parents and guardians was not involved in the data exfiltration.

ETS immediately shut down the account used by the intruder and took the SFTP site offline to prevent further access. The organization is now building a replacement site with stronger safeguards to secure future data transfers. The California Department of Education has published an incident FAQ to provide clarity on the scope of the breach and the types of data involved.

What should you do?

Educators and administrators should review their access logs for any unusual activity on file transfer systems. Schools should verify that their data sharing agreements with third-party vendors include strict security requirements. Parents should monitor their children’s academic records for any signs of unauthorized changes or discrepancies.

What to do and how to stay safe: Educational Testing Service

• Review institutional data sharing agreements to ensure vendors adhere to strict security protocols for sensitive student information.
• Monitor academic and personal records for any unauthorized changes that could indicate identity theft or data manipulation.
• Verify that file transfer systems used for sensitive data employ multi-factor authentication and regular access audits.
• Stay informed about official notifications from the California Department of Education regarding updates to the breach investigation.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific types of student data were exposed in the ETS breach?

The breach exposed names, birth dates, addresses, ID numbers, disability status, testing accommodations, and academic results.

Did the breach include Social Security numbers or financial data?

No, the breach notice confirms that Social Security numbers, passwords, and financial account details were not involved.

How long did the attackers have access to the ETS server?

Attackers accessed the server between May 22 and September 18, 2026, before ETS detected the activity on September 25.