The California Department of Education announced on October 16 that attackers used a compromised login credential to reach a secure FTP site run by contractor Educational Testing Service, exposing records of all students enrolled in California public schools over the past three years, plus some former students dating to 2006. ETS began notifying families the same day, and notifications continue through early November.
Compromised Credential Gave Attackers Nearly Five Months of SFTP Access
The department said attackers used a compromised credential to access an ETS secure FTP (SFTP) site that transfers statewide assessment data between ETS and the department. They remained in the system for nearly five months. ETS discovered the intrusion on September 25.
ETS, a New Jersey nonprofit, administers California’s CAASPP and ELPAC testing programs. On October 2, it told county and district officials it had stopped normal enrollment data processing.
Scale: Millions of Students Across More Than 1,000 Districts
The scope is large. More than 5.7 million students were enrolled in California public schools in 2025-26 across over 1,000 districts. The exposed records cover all students enrolled over the past three years, along with some former students going back to 2006.
What ETS Says Was and Was Not Accessed
The full list of exposed data fields has not been published in the coverage reviewed. ETS says Social Security numbers, driver’s license and passport numbers, financial account and card data, passwords and parent or guardian information were not accessed.
There is no evidence the data was made public. That statement is limited to what has been found so far, and the investigation details have not been published.
Credential-Based Access to a Data-Transfer Channel
The method, a single compromised credential used against a file-transfer site, is a common route into systems that move data between organizations. SFTP sites serve as handoff points between a contractor and a state agency, and the access that lets a legitimate process move files can also let an attacker pull them. The nearly five months between entry and discovery shows how long such access can go unnoticed when a valid credential is used.
The timeline raises questions the department and ETS have not yet answered: how the credential was obtained, why the activity went undetected for so long, and whether the site had multifactor authentication or access limits tied to specific systems.
Response: Notifications and Two Years of Identity Protection
The Department of Education is offering two years of free Experian IdentityWorks identity protection to affected current and former students. ETS began notifying families on October 16, and the notifications will continue through early November, so some families will not hear until weeks after the announcement.
Guidance for Families and Districts
Families who receive a notice should enroll in the offered identity protection. Districts have already been told that ETS stopped normal enrollment data processing on October 2, which may affect how assessment data flows until processing resumes.
For districts and agencies that depend on contractors to handle student data, the incident points to the credentials those contractors hold. Contract terms and audits covering authentication, logging and monitoring of transfer sites are the relevant controls. The department has not said whether it will change its requirements for ETS or other vendors, and that decision will indicate how much of the response focuses on this contractor versus statewide practice.
The department said the exposed records span a three-year enrollment window and reach back to 2006 for some former students, so the affected group includes adults who left California schools years ago and may not expect a notice. Families of former students should watch for the letters ETS is sending through early November.
