ETS Data Breach Affects California Public School Students
The California Department of Education confirmed the unauthorized copying of student data files from a service operated by ETS. The number of affected people has not yet been disclosed.
The ETS data breach involves files containing information about California public school students. On October 16, the California Department of Education (CDE) confirmed that an attacker unlawfully accessed an SFTP service operated by Educational Testing Service (ETS) and copied student data from it.
According to the CDE, the attacker used a compromised credential between May 22 and September 18, 2026. ETS identified the suspicious activity on September 25. It is not publicly known who the credential belonged to, how the attacker obtained it, or who was behind the attack.
The ETS data breach includes identification and school data
The scope of the exposed data varies by individual. The files may have contained names, state student identifiers, dates of birth, addresses, and demographic information. Potentially affected items also include information about disabilities, program participation, and state test results.
The CDE also stated that the files affected by the incident did not contain Social Security numbers, financial information, passwords, or parent or legal guardian data. This was therefore not a breach of login passwords or payment data, although the combination of a name, address, date of birth, and unique state identifier could increase the risk of targeted phishing communications or identity theft.
The CDE has not disclosed the exact number of affected individuals. The notices apply to all students enrolled in California public schools during the three preceding school years, as well as some former students recorded since 2006. Media outlets therefore refer to a possible scope of millions of records, but this is not an officially confirmed number.
The original SFTP service was taken offline
After detecting the activity, ETS shut down the affected SFTP service and created a new service with enhanced controls. SFTP is a protocol designed for secure file transfers; in this case, however, the compromised credential enabled data to be copied over several months.
The organization is also providing affected current and former students with a two-year Experian IdentityWorks service. The CDE says it is sending notices to recipients stating that their data was accessed and copied.
The breach is significant mainly because it involves data processed by a central provider of state testing and may include sensitive information about minors. A specific measure by the operator has also been confirmed: the original service is no longer in operation and has been replaced with a new one.
What remains unclear
The CDE has not found evidence so far that the stolen information was published. This alone does not confirm that the data will not be distributed or misused later. Authorities have also not announced whether the attacker made extortion demands.
Questions remain about the exact number of affected people, the full scope of the copied files, and the circumstances surrounding the compromised credential. It is also unknown whether evidence of the data being sold, published, or otherwise misused will emerge.
Sources
- California Department of Education – ETS Data Security Incident – Confirms unauthorized access and data copying, data categories, the shutdown of the SFTP service, the absence of Social Security and financial data, and the offer of two years of identity protection.
- California Department of Education – Educational Testing Service (ETS) Incident – Provides the date the incident was detected, the access period from May 22 to September 18, 2026, the use of a compromised credential, and the groups of affected students.
- California Department of Education – ETS Notification – Confirms that affected individuals are being sent notices stating that their data was accessed and copied.
- SecurityWeek – Independently reported on the incident and frames its possible scope as millions of records.
Verified and updated: October 19, 2026 15:21
