ETS breach: one stolen login and student records kept since 2006

One stolen password has put the records of millions of California schoolchildren in a stranger's hands. Education Week ran the Los Angeles Times report, which says ETS discovered the hack on Sept. 25. A subsequent investigation found that "an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026". ETS (Educational Testing Service) is the nonprofit that runs California's statewide tests. The target was a secure file transfer protocol (SFTP) server, a drop box the contractor and the state use to swap assessment files.

The scope is what makes data leaders wince. According to Cybernews, hackers gained access to the records of all students enrolled in California public schools over the past three years, as well as some former students dating back to 2006. The stolen fields include disability status, testing accommodations, primary disability type. GovTech reports that attorneys representing the plaintiffs estimated that approximately 7 million current and former California public school students were affected. SecurityWeek adds that the files did not contain Social Security numbers, passwords, or financial account or payment card details. Information on parents and guardians was not involved either.

Why it matters: nobody needed an exotic exploit. One working credential opened a hub that gathers data in one place by design. A cybersecurity expert quoted by Education Week said "A stolen login credential should not become a months-long passport to millions of students' personal records". The 2006 records also raise a retention question that the official notices leave unanswered.

Blame is the contested part. GovTech reports that the California Department of Education is reviewing ETS' compliance with applicable contractual and data-security requirements. The law firm Cotchett, Pitre & McCarthy has filed a class action, and according to Business Wire its attorney Andrew Fuller warned that it may be years before they open their first bank account or credit card and realize that criminals have exploited their data. ETS's side, per SecurityWeek: it shut down the account the intruder used and pulled the SFTP site offline. Its response also includes building a replacement site with stronger safeguards. ETS also says its web monitoring has so far found no evidence that the data has been published. Education Week answers that hackers will often keep information confidential pending the outcome of a ransom demand. The official release did not say whether such a demand has been made.

What to watch: student notifications started going out on October 16, and CDE expects them to continue into early November. And the official disclosures do not explain how the login credential was compromised, and they do not identify the attacker. The state's review should show whether ETS failed its contract or the contract never asked for enough.