Educational Testing Service (ETS), the nonprofit that runs California's statewide tests (CAASPP and ELPAC) under contract, is notifying students and families at the California Department of Education's direction. According to the notice, ETS found unauthorized activity on Sept 25 on an SFTP site used to exchange assessment data with CDE. An unauthorized party had used a compromised login credential at various times from May 22 to Sept 18, 2026 to copy files with California student information. The notice says the data covers, "including but not limited to", all students enrolled in the three previous school years. CDE gives no count. Politico reports CDE put it at about 7 million students, and SecurityWeek, citing CDE's FAQ, says some students who left as far back as 2006 are also included.

Data varies by student: name, date of birth, address, school, district and grade; statewide and local student IDs; gender, race/ethnicity, primary language, country of origin and English-learner status; disability and Section 504 status, primary disability type and testing accommodations; Title I, McKinney-Vento and military-connected eligibility; and test registration, participation and results. The notice says there were no SSNs, driver's license or passport numbers, financial or card data, or passwords, and no parent or guardian data. ETS disabled the account, took the SFTP site offline and is building a replacement. It says it "has taken steps to reduce the potential risk of the data being made publicly accessible" and hasn't seen it published. The notice doesn't say how the credential was stolen or who did it. Notices started Oct 16 and run into early November. Students get two years of Experian IdentityWorks, with enrollment open until March 19, 2027.

For defenders: this is another long-dwell file-transfer breach that came down to a single credential. Check any partner SFTP or MFT accounts you hold or issue for MFA (or key-only auth), IP allowlisting and download alerting. Here the intruder came and went for four months before anyone noticed.