ETS data breach: one stolen SFTP login exposed student records

October 27, 2026 · 9 min · Free, with full transcript

How did one compromised login give an intruder nearly four months inside the SFTP server where California swapped student test data with Educational Testing Service (ETS)? The files held names, test results, disability status, Section 504 status and records on students who left as far back as 2006. The hosts split on blame: ETS for the dwell time, or the state for pooling every child's record at one vendor behind one login. You walk away able to audit your own vendor file drops: name an owner, check whether MFA is on, enforce data minimisation with a scheduled deletion job, and treat contract clauses as no substitute for controls that block a bulk download at midnight.

Listen to the podcast

9 min

Chapters

Key takeaways

  • Give every SFTP file drop that feeds a vendor a named owner, since folders often belong to someone who left long ago.
  • Enforce data minimisation with a scheduled deletion job, not only a written policy.
  • Do not pool every record at one vendor behind one login when the job does not need it.
  • Treat a contract clause as a promise on paper and require controls that detect unusual bulk downloads.
  • Check whether multifactor authentication is on for every file transfer account.
Read the full transcript

Host:You're listening to MBA Training. Today's subject: ETS breach: one stolen login and student records kept since 2006. Somebody had a working login to the file drop where California swaps student test data with its testing contractor, and they used it, on and off, for nearly four months.

Expert:And nobody spotted it until late September. I keep rereading the notice and it doesn't get any better.

Host:Wait, how many kids are we talking about?

Expert:The lawyers suing say about seven million, current and former students. The state still hasn't put out its own final count.

Host:And the contractor is ETS.

Expert:Educational Testing Service, the nonprofit that runs California's statewide tests. The intruder got into an SFTP site (secure file transfer protocol), which is a server where two organisations drop files for each other. Think of it as a loading dock for data.

Host:A loading dock with the key under the mat.

Expert:One compromised login credential, says the official notice. Nobody has said how it got compromised, or who used it.

Host:Nobody ever got a keynote for an SFTP server.

Expert:Never. Every conference stage this autumn is agents and copilots, and the thing that leaked is the least glamorous box on the architecture diagram.

Host:So what's in the files? Bad news first.

Expert:Names, birth dates, home addresses, student ID numbers, race and ethnicity, primary language, test results. And going by the state's list as Cybernews reported it: disability status, testing accommodations and primary disability type.

Host:Hang on, say that again.

Expert:Primary disability type. Plus Section 504 status, which is the US plan that gives a student with a disability adjustments at school.

Host:Honestly, that one lands hard. That's what a parent tells one teacher, quietly, in a small meeting room.

Expert:Same for me. And now it's in a stranger's copy.

Host:OK. What didn't they get?

Expert:No Social Security numbers, no passwords, no bank or card details, nothing on parents. SecurityWeek has that straight from the notice.

Host:So they got everything except the stuff you can replace.

Expert:You can cancel a credit card. Nobody's cancelling their birth date.

Host:Now the part that made me put my coffee down. How old some of these records are.

Expert:Right. First group: basically every kid enrolled in recent years. Second group: kids who left California without a confirmed transfer to another school.

Host:Going back how far?

Expert:To 2006. Education Week, running the Los Angeles Times story, has that detail.

Host:Some of those records are old enough to vote.

Expert:The people in them definitely are. Adults now, living somewhere else, getting a letter about a test they sat as kids.

Host:Why is a contractor's file drop still holding a kid who left back then?

Expert:The notices don't say. My guess, and it's only a guess, is that the state keeps tracking students who disappeared without a confirmed transfer, for things like dropout counts. That's a legitimate public need.

Host:Oh, come on. Legitimate for the state's own records. Not for a pipe to a vendor.

Expert:That's my question too. A record can have a good reason to exist and still have no business sitting on a loading dock.

Host:Data minimisation, then.

Expert:Keeping only what the job in front of you needs, for as long as it needs it. Everyone has it in a policy. Far fewer people have it in a cron job.

Host:Define cron job before the emails start.

Expert:A scheduled task. The dull little script that deletes things on time.

Host:Here's where I land, and I'll be blunt. This is on ETS. One password, months of access, nobody watching what left the building.

Expert:I think that's too comfortable.

Host:Too comfortable? They had one job.

Expert:They did, and I won't defend the dwell time, meaning how long an intruder sits inside before anyone notices. A security expert quoted in Education Week said a stolen login shouldn't become "a months-long passport" to students' records. I agree with that.

Host:So we agree.

Expert:On that. But the state designed a flow that pools every child's record in one place, at one vendor, behind one login. The attacker didn't have to visit every district. The data came to them.

Host:Pooled with a vendor the state pays to guard it.

Expert:Sure. And GovTech reports the department is reviewing whether ETS met its contractual and data-security requirements. But a contract clause is a promise on paper. A control is the thing that blocks a weird bulk download at midnight.

Host:That's a slide, and you know it. ETS still left the door open.

Expert:And the state still built a house where one door opens every room.

Host:We're not going to agree on this.

Expert:No. Good.

Host:Fine. Steelman ETS for me: the strongest honest version of their case.

Expert:They spotted it, killed the account, took the site offline and built a new one with stronger controls. They say their web monitoring hasn't found the data published anywhere. And the lawsuits are proposed class actions, cases brought on behalf of a whole group, so for now they're allegations, not findings.

Host:"Not found published" is doing a lot of lifting.

Expert:It is. Education Week notes that hackers often sit on stolen data while a ransom negotiation plays out, and the official release didn't say whether there was a demand.

Host:Meanwhile the ETS spokesperson said no other "ETS customers" were affected.

Expert:Wonderful news for everyone who isn't a California schoolchild.

Host:And once they found it, how fast did people hear?

Expert:ETS told the department the day after it spotted the activity. District superintendents got a letter about two weeks before families started hearing anything.

Host:So there's a window where the superintendents knew and the parents...

Expert:...didn't. And everyone chose their words very carefully, I'd imagine.

Host:I would pay real money to read that group chat.

Expert:It broke the plumbing too. According to SecurityWeek, ETS stopped its regular processing of enrollment data and suspended some testing work while its security was checked. And notices are still going out into early November.

Host:Who wins here? Somebody always does.

Expert:Plaintiffs' lawyers, on current evidence. Cotchett, Pitre & McCarthy filed one suit, and their attorney Andrew Fuller made the sharpest point I've read: a kid might not open a bank account or a credit card for years, and only then find out criminals used their data.

Host:That's grim. A breach with a fuse on it.

Expert:A slow fuse. Officials are already suggesting parents freeze credit for children under sixteen. In my view, that tells you how long the tail could be.

Host:Let me push on the boring infrastructure point. Is the real scandal that nobody owns these file drops?

Expert:In my view, yes. Pipelines get owners, dashboards get owners. The typical SFTP folder belongs to whoever set it up, and they often left ages ago. The obvious open question here is MFA (multifactor authentication, the second check after a password), and the notices don't say whether it was on.

Host:That's the detail that ends careers in a proper post-mortem, the after-the-fact review.

Expert:Maybe. Or it turns into a contract amendment and everyone moves on.

Host:The bold version is a state that treats every file drop as a product, with a named owner and a deletion date.

Expert:I'd love that. I'd also love a pony.

Host:Cynic.

Expert:Realist. Though some chief data officer in some state department probably just got the budget they've been begging for.

Host:So what are you watching?

Expert:The department's review of ETS, because it decides whether this was a vendor failing its contract or a contract that never asked for enough. Whether the data shows up anywhere. And the missing fact: how that login was stolen.

Host:And whether somebody finally gets a keynote for an SFTP server.

Expert:Front row. I'd bring snacks.

Host:What I can't shake is simpler. Somewhere in that chain, a person decided a child's disability record from years back should stay on a loading dock, and I don't think anyone can tell us who.

Expert:Neither can I. And I'm not sure most organisations could name that person in their own building either.

Host:Drawn from Education Week, Cybernews and GovTech, links in the show notes. That's the episode. If you want the structured version, the CDO track is at mba-training.com.

Read and go deeper