Contractor Breach Exposes Millions of California Student Records
Unauthorized access to an ETS file server compromised sensitive education data for millions of students, prompting state-led notification efforts.
Key points
- An attacker used stolen credentials to access an Educational Testing Service SFTP site between May 22 and September 18.
- The breach affects millions of current and former California public school students, exposing disability and test score data.
- Social Security numbers, financial details, and passwords were not included in the stolen files.
Educational Testing Service, a nonprofit contractor for the California Department of Education, experienced a significant data breach involving millions of student records. According to Malwarebytes Labs, an unauthorized party accessed a secure file transfer protocol site operated by ETS. The intruder copied files containing sensitive personal information belonging to current and former public school students in California.
The risk
The investigation revealed that the attacker used compromised login credentials to gain entry to the system. This access occurred at various times between May 22 and September 18. The stolen files contain highly personal information about students' education histories. This includes details on disability status and participation in specific educational programs. It also includes statewide assessment information, such as test scores. This data is far more sensitive than basic contact information.
Who is exposed
The California Department of Education states that the breach includes all students enrolled during the previous three school years. However, the affected population is not limited to that specific group. Over 5.7 million students were enrolled in California public schools during the 2025–2026 school year alone. Not every affected student had every category of information exposed. The specific data stolen varies by individual record.
Cost and compliance
The California Department of Education is distributing breach notices to help affected individuals receive information. ETS is notifying affected students and families at the direction of the CDE. The CDE confirmed that Social Security numbers were not involved in the breach. Financial account information, passwords, and parent or guardian information were also not included in the stolen files. ETS stated it has found no evidence that the stolen information has been made public so far.
What happens next
Managers should verify any communication about the incident through official channels immediately. They should consider enrolling in the two years of free identity-protection services offered to affected individuals. Parents can enroll minors, while adults can enroll themselves. Teams must watch for messages that use details about a child or their school to sound convincing. Do not share passwords or payment details in response to unsolicited messages.
Questions to ask your suppliers
Organizations should ask vendors how they authenticate access to secure file transfer systems and whether multi-factor authentication is mandatory. Check if suppliers conduct regular audits of user credentials to detect compromised accounts quickly. Determine who within your organization, such as legal or compliance teams, needs to be notified immediately upon receiving breach notices. Establish a protocol for verifying the authenticity of communications from third-party vendors during security incidents to prevent follow-on phishing attacks.
Background: Phishing
Phishing is not just about fake links or poor spelling. It exploits human psychology, bypasses technical filters through legitimate channels, and targets individuals regardless of their technical skill. Relying solely on software leaves critical gaps that human verification and multi-factor authentication must fill.
Read the full guide: Phishing Myths Debunked: Why Common Beliefs Leave You Vulnerable
What to do and how to stay safe: Educational Testing Service
- Verify any communication about the incident through official channels to ensure it is legitimate.
- Consider enrolling in the free identity-protection services offered to affected individuals and families.
- Watch for messages that use details about your child or their school to sound convincing.
- Do not share passwords, security codes, or payment details in response to unsolicited messages.
Step-by-step guide: Data Breach Myths: Why Common Security Beliefs Fail
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific data was stolen in the ETS breach?
The stolen files may include disability information, program participation details, and statewide assessment information including test scores.
Were Social Security numbers or financial data compromised?
No, the California Department of Education confirmed that Social Security numbers, financial account information, and passwords were not involved.
How can I tell if a message about the breach is real?
Verify any communication through official channels and be wary of messages using personal details to sound convincing.
