The California Department of Education (CDE) says Educational Testing Service (ETS), a nonprofit assessment organization under contract with the department, has begun notifying students and families after "unauthorized access to and copying of student information" from an ETS-operated secure file transfer protocol (SFTP) site. SecurityWeek reports that, according to the CDE, "an unauthorized party used a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026." ETS spotted the unauthorized activity on Sept. 25.

SecurityWeek reports that ETS supports California's statewide testing programs, the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC). The exposure reaches current and former students across the state, not just one district or one school year.

The CDE confirms that student information was accessed and copied. According to the CDE release, ETS's regular web monitoring has so far found no evidence that the information has been made public. The official notices do not explain how the credential was compromised and do not identify the attacker.

Timeline

  • May 22 to Sept. 18, 2026: According to the CDE, as reported by SecurityWeek, an unauthorized party used a compromised login credential to access the ETS SFTP site at various times during this period of nearly four months.
  • Sept. 25, 2026: ETS spots unauthorized activity on the site.
  • Oct. 2, 2026: According to SecurityWeek, the CDE informs county and district superintendents and charter school administrators in a letter.
  • Oct. 16, 2026: The CDE issues News Release #26-45, and notifications to affected students and families begin.
  • Early November 2026: The CDE expects notifications to continue through this period.

About four months passed between the start of the access window and detection. According to the CDE, the credential was used at various times during that period, not in a single session, and the activity was not caught until late September.

What Data Was Taken

The CDE says the information involved varies by individual and may include:

  • Student names
  • Statewide Student Identifiers (SSIDs)
  • Dates of birth
  • Addresses
  • Demographic information
  • Disability and program participation information
  • Statewide assessment information

SecurityWeek gives more detail from the notice. It says the data includes school, district, and grade; state and local IDs; gender, race or ethnicity, primary language, country of origin, and English learner status. Some records include disability and Section 504 status, testing accommodations, English proficiency data, test registration and results, and Title I, McKinney-Vento, or military-connected designations.

The CDE says the incident did not involve Social Security numbers, financial account information, passwords, or parent or guardian information.

Without Social Security or financial data, this set is less useful for straightforward financial fraud. It is still sensitive. Disability status and program participation are among the most protected categories of student information. A name combined with a birth date, home address, and a persistent state identifier gives a scammer enough to write a convincing phishing message or pretexting call aimed at families. Because the people affected are children, many of them will not have credit files for years, so misuse of their identities can go unnoticed for a long time.

How Many Students Are Affected

Neither the CDE nor ETS has published a total. SecurityWeek reports that, according to the notice, data on all students enrolled in the previous three school years may have been accessed. The affected group also includes students who left a California school as far back as 2006 and whose transfer was not confirmed with the CDE. For scale, SecurityWeek notes that the CDE reports more than 5.7 million students enrolled in California public schools in 2025-26. That enrollment figure gives context only. It is not a count of affected individuals, and ZeroDayFeed will update this story if the CDE, ETS, or a state regulator publishes an official number.

What ETS and the State Have Done

The CDE says ETS took the SFTP site offline, built a new one with enhanced security controls, and continues to evaluate additional security measures. ETS also worked with law enforcement and cybersecurity experts to reduce the risk of the data becoming publicly accessible. SecurityWeek reports that ETS shut down the account the intruder used. It also stopped its regular processing of enrollment data and suspended some testing work while its systems were evaluated. The CDE and the State Board of Education are coordinating with state cybersecurity partners and the vendor to assess the incident and prepare notifications and resources.

Affected current and former students are being offered two years of Experian IdentityWorks identity-protection services at no cost. The ETS Notice of Data Breach is available in 27 languages on the CDE website. The CDE has also posted an ETS Incident web page with the latest updates. Both are linked below.

Several questions remain unanswered in public:

  • How the credential was obtained, whether by phishing, reuse from another breach, malware on an endpoint, or some other route.
  • Whether the account was protected by multi-factor authentication or was a service or shared account.
  • Why the access went undetected from May 22 until Sept. 25.
  • Who was responsible. The official notices do not identify the attacker.

What It Means for Defenders

The most useful lesson here is not a CVE. It is a valid credential on a file-transfer system that was used repeatedly over roughly four months before anyone noticed. Organizations that move bulk sensitive data through SFTP or similar managed file transfer (MFT) systems, particularly to and from contractors, should treat those systems as high-value targets. Concretely:

  • Inventory every account on your file-transfer systems. That includes vendor, service, and integration accounts. Remove stale ones and identify any shared credentials.
  • Move to key-based or certificate-based authentication with MFA where the platform supports it. Avoid password-only interactive logins on systems that hold regulated data. Bind service accounts to specific source IP ranges.
  • Rotate credentials on a schedule and after any incident. If a contractor tells you about a credential compromise on a system you share data with, rotate every credential that touches that integration, not only the one named.
  • Alert on volume and timing, not just on failed logins. A valid credential pulling files at unusual hours, from unfamiliar IP addresses, or in unusual quantities should trigger review. In this case the compromised credential was used at various times over a period of months.
  • Apply data minimization to transfer sites. Files should not stay on a staging SFTP server after they have been processed. Retention limits on drop zones reduce what one compromised login can reach.
  • Review your contracts with data processors. Make sure they require prompt breach notification, logging you can audit, and specific authentication controls. Education agencies and districts that send data to testing and assessment vendors should confirm those terms are in place.

School districts and IT staff in California should expect phishing that references the ETS notice. Tell families to verify any notice against the CDE's official incident pages, and warn that nobody should click links or provide information in response to an unsolicited call or email claiming to be about the incident.

Families who receive a notice should consider enrolling in the offered Experian IdentityWorks coverage, and should watch for mail or messages that use their child's name, school, or test history in an unexpected way. Enrollment information is in the notification letter and on the CDE's notice page.

Sources