Compromised login let hackers copy California student records from ETS server for months

The California Department of Education disclosed on October 16, 2026 that an unauthorized party used a compromised login credential to reach a secure file transfer protocol site operated by the Educational Testing Service and copy files holding California student information, an intrusion that investigators later determined unfolded at various times between May 22 and September 18, 2026. The department published an incident notice and FAQ the same day, confirming that ETS identified the unauthorized activity on September 25, 2026, disabled the account involved, took the affected SFTP site offline and brought in external cybersecurity experts.

ETS is a nonprofit assessment organization under contract with the State of California to provide state and federally required testing to all students enrolled in California public schools. That work supports the California Assessment of Student Performance and Progress, known as CAASPP, and the English Language Proficiency Assessments for California, known as ELPAC. The SFTP site at the center of the incident existed to exchange statewide assessment information between the contractor and the department, which is why its contents spanned the entire state rather than a single district.

Oversight of California's testing program runs through the California Department of Education and the California State Board of Education, while the actual administration of the assessments sits with the contractor. That arrangement placed one vendor operated file transfer server in the path of records covering students in every county in the state.

The Los Angeles Times reported on October 16 that hackers stole names, addresses and disability records of millions of current and former California public school students who took the state's mandated standardized tests. The newspaper said the compromised information affects many more people than the state's current 5.7 million public school students, because the breach reaches back to 2023 enrollments and, for students who left California without confirming a transfer to another school, to records dating back to 2006.

Key Facts

The department said on October 16 that information about California students, including but not limited to all students enrolled in the three previous school years, was accessed and copied. The data varies by individual but may include student names, dates of birth, residential addresses, schools, districts, grade levels, the Statewide Student Identifier, the local student identifier, gender, race or ethnicity, primary language, country of origin, English learner status, disability and Section 504 status, testing accommodations, primary disability type, and eligibility for programs including Title I Part A, Title I Part C, McKinney-Vento and Military Connected Student.

According to the same notice, the copied files did not include Social Security numbers, driver's license numbers, passport numbers, financial account information, credit or debit card information or account passwords, and no parent or guardian personal information was involved. Cybernews reported on October 17 that the attackers spent nearly five months inside ETS systems before the activity was caught. Politico reported on October 16 that the incident involved data on all students enrolled in California public schools over the previous three years, with some records of former students dating back to 2006.

Politico also reported on October 16 that affected current and former students are eligible for 24 months of free Experian IdentityWorks identity protection services and identity restoration help, with an enrollment deadline of March 19, 2027 for adults. ETS began notifying affected students and families on October 16, and notifications are expected to continue through early November.

Remediation has already begun on several fronts. The department said ETS built an entirely new SFTP site with enhanced security controls, and ETS told Reuters in a statement that it implemented additional safeguards, including enhanced monitoring, strengthened access controls and further third-party review of its security practices. The California Cybersecurity Integration Center is assisting with digital forensics and incident response, with the California Department of Technology and the Governor's Office of Emergency Services supporting the response.

Timing details matter here. ETS identified the unauthorized activity on September 25, 2026, yet the first public notice came on October 16, 2026, and school district leaders had received word on October 2. Cybernews reported on October 17 that ETS sent a letter to county and district school officials on October 2 stating that it had stopped normal enrollment data processing, disrupting CAASPP and ELPAC testing. ETS spokesperson Christine Betaneli told the Los Angeles Times that no other ETS customers were affected. Following web monitoring, ETS has to date not uncovered evidence that the information has been made public.

Analysis

What this really means is that the security of millions of student records rested on the integrity of a single login. Nothing in the public record so far describes a sophisticated exploit, a zero day or a supply chain compromise. The intruders used a compromised login credential to sign in to a file transfer server and copy files. That is the entire mechanism, and it worked for nearly four months without being caught.

The dwell time is the part that should worry institutions well beyond California. The access window ran from May 22 to September 18, 2026, and detection did not arrive until September 25, 2026. A file transfer site exists to move data between two parties on a schedule, which means abnormal volumes or unusual hours should be visible in logs. Whether anyone was watching those logs, and how the credential was compromised in the first place, are questions the external forensics and the California Cybersecurity Integration Center review will have to answer.

Anton Dahbura of the Johns Hopkins University Information Security Institute framed the failure plainly, telling the Los Angeles Times that a stolen login credential should not become a months-long passport to millions of students' personal records. His point cuts past the technical detail. Identity and access management, session monitoring and rapid revocation are dull, unglamorous controls, and they are precisely the controls that failed.

The bigger picture here is concentration risk in public sector contracting. One nonprofit vendor performs required testing for the entire state, so its file transfer server holds records that no single district could ever accumulate on its own. The California State Board of Education and the California Department of Education set the testing requirements, but operational custody of the resulting data sits with an outside organization based in New Jersey. When that custody fails, the consequences arrive statewide and all at once rather than locally.

Why It Matters

The scale alone is unusual. The Los Angeles Times reported on October 16 that the breach affects many more than the state's current 5.7 million public school students, and Politico reported on October 16 that reporting cited by other outlets put the figure at roughly 7 million. Records of students who left California and never confirmed a transfer stretch back to 2006, which means adults who have not attended a California school in two decades may still need to check whether they are affected.

The categories of data involved are more sensitive than a bare name and address list. Disability and Section 504 status, primary disability type, testing accommodations, English learner status, country of origin, primary language, and eligibility for Title I Part A, Title I Part C, McKinney-Vento and Military Connected Student programs all describe a child's circumstances. The absence of Social Security numbers, financial account information and passwords narrows the direct financial risk, but not the risk of targeted social engineering aimed at families.

There is also the practical burden on families. The remedy offered is 24 months of free Experian IdentityWorks identity protection and identity restoration help, with an enrollment deadline of March 19, 2027 for adults. That requires parents, guardians and former students to find the notice, complete enrollment and monitor their accounts, shifting the labor of a vendor's security failure onto the people whose data was copied.

Next Up

Notifications from ETS began on October 16 and are expected to continue through early November, so many affected families have not yet received word. The digital forensics and incident response work led by the California Cybersecurity Integration Center, with support from the California Department of Technology and the Governor's Office of Emergency Services, is ongoing, and the question of how the login credential was compromised remains unanswered in the public record.

Attention now turns to oversight from the California Department of Education and the California State Board of Education, and to questions about how a contractor's file transfer server came to hold three years of statewide assessment data plus records reaching back to 2006, and what security requirements will apply to the rebuilt SFTP site. The enrollment deadline of March 19, 2027 gives affected students and families until early next spring to claim identity protection, but the policy reckoning over a four month undetected intrusion will take considerably longer.