ETS breach exposes California student testing records

In late October 2026, the California Department of Education (CDE) and its testing contractor Educational Testing Service (ETS) disclosed that an intruder had used a single compromised login credential to copy years of California student records from an ETS secure file-transfer (SFTP) server — a breach that officials warned could affect millions of students. ETS, the Princeton, New Jersey nonprofit that administers California's statewide assessments (CAASPP and ELPAC), detected the unauthorized activity on 25 September 2026.

According to CDE's notice, the unauthorized access ran from 22 May to 18 September 2026, and the copied files covered all students enrolled in the three previous school years, with some records reaching back to 2006. California enrolled more than 5.7 million public-school students in 2025–26 alone, a figure that functions as a ceiling for the current cohort rather than a confirmed victim count; no official number of affected individuals had been published as of disclosure.

What was exposed

The exposed fields are unusually detailed for a student dataset. Per the disclosures they include names, dates of birth, home addresses, schools, districts, grade levels, state and local student IDs, gender, race or ethnicity, primary language, country of origin, and English-learner status. Some records additionally contain disability and Section 504 status, testing accommodations, test registrations and results, and designations such as Title I, McKinney-Vento (homeless), or military-connected status. CDE stated that Social Security numbers, passwords, financial or payment-card details, and parent or guardian information were not involved.

Response

ETS said it disabled the account the intruder had used, took the SFTP site offline, and is building a replacement with stronger safeguards; it also paused regular enrollment-data processing and some testing work. The organization said its web monitoring had found no evidence that the stolen data had been published, and it is offering affected students two years of free identity-protection services. No threat actor has been identified. Because the intrusion vector has been closed and there is no evidence of publication, but notifications and the investigation are ongoing, the incident's status is contained.

Why it matters

The breach is a textbook illustration of third-party and credential risk in the education sector: a single compromised login at a contractor exposed one of the most sensitive data classes imaginable — detailed records on minors, including disability and special-program designations — across an entire state's school system. It also underscores how long-retained historical data (records back to 2006) multiplies the blast radius of a single-credential compromise well beyond the current student body.