One Compromised Login Exposed Millions of California Students’ Records

What it is

Between 22 May and 18 September 2026, an unauthorized party used one compromised login credential to copy files from an SFTP site run by Educational Testing Service (ETS). ETS is a nonprofit contractor that handles California's CAASPP and ELPAC assessment programs and used the site to share testing data with the California Department of Education (CDE). ETS spotted the unauthorized activity on 25 September, about four months after the earliest access.

What was exposed

The CDE notice says the files covered all students enrolled in the three previous school years, "but not limited to" them. CDE counts more than 5.7 million students enrolled in 2025-2026. Former students are also affected back to 2006, where a transfer to another school was not confirmed with CDE.

Baseline fields include name, birth date, home address, school, district, grade, state and local IDs, gender, race or ethnicity, primary language, country of origin and English learner status. Some records also hold:

• disability and Section 504 status, primary disability type and testing accommodations
• English proficiency data, test registration and test results
• Title I, McKinney-Vento and military-connected designations

The files held no Social Security numbers, passwords, financial or card data, or parent and guardian information.

Response and timeline

ETS disabled the account, took the SFTP site offline and is building a replacement with stronger safeguards. It worked with law enforcement and security experts on steps to reduce the risk of publication, but did not say what those steps were. Its web monitoring has found no sign the data has been published.

CDE wrote to county and district superintendents and charter administrators on 2 October. ETS paused regular enrollment data processing and suspended some testing work during the security review. Student notifications began 16 October and are expected to run into early November. Affected current and former students can enrol in two years of free identity protection.

Caveats

The disclosures do not say how the credential was compromised, who the attacker is, or how many people are affected. No victim count has been given beyond the enrollment figure. The page does not say whether the account had multi-factor authentication or what monitoring was in place, so it supports no conclusion about why the access went unseen for four months.