- The California Department of Education says an intruder used one compromised login to copy student files from a file transfer site run by its testing contractor, ETS.
- The state has given no victim count. It says the data covers at least all students enrolled in the three previous school years.
- Leaders should ask which vendors run file transfer sites for them, how those logins are protected, and how long old data stays on them.
Organisations spend heavily to protect their own systems. Then they hand the same data to a contractor and trust a side channel to carry it. The California student data breach shows where that trust can fail. The weak point was not a school database. It was the pipe between two institutions.
What the state says happened
Educational Testing Service (ETS) is a nonprofit that runs state and federally mandated testing for California under a contract. It supports the CAASPP and ELPAC assessment programs. ETS sent testing results to the California Department of Education (CDE) through a secure file-transfer site, known as SFTP. In plain terms, that is an encrypted route for moving files between two organisations.
SecurityWeek reports that ETS noticed unauthorized activity on that server on September 25. By then the problem was months old. CDE's breach notice defines the window of unauthorized access as May 22 to September 18, 2026. Inside it, the notice says, someone signed in several times with a compromised login credential and copied files holding student information.
ETS disabled the account the intruder had used and took the whole site out of service. A replacement with tougher protections is being built. ETS says its monitoring of the public web has found no sign so far that the data has been published.
How a single login becomes a data store
SFTP is a long-standing way to move files between organisations. Think of it as a locked loading dock. Whoever holds a valid username and password can walk in and collect what is stored there.
That is the mechanism here. The notice describes a compromised credential, not a software flaw. The intruder did not need to break the lock. They appear to have used a key that already worked. According to the notice, this was not one event. It happened repeatedly across about four months.
Neither CDE nor ETS has said how the credential was compromised. The attacker has not been named. Those gaps matter, and no one outside the investigation can fill them.
What the files contained
No victim count has been provided. The notice says information about California students, "including but not limited to all students enrolled in the three previous school years," was accessed and copied. CDE's own enrollment data shows more than 5.7 million students in California public schools in 2025-2026. The state's FAQ says the exposure reaches further back. Students who left a California school as early as 2006, and whose transfer the state never confirmed, are also in the affected group.
SecurityWeek reports that the records can hold basic identity and school details. These include name, birth date, home address, school, district, grade, and state and local ID numbers. They may also list gender, race or ethnicity, main language, country of origin and whether a child is learning English.
The more sensitive layer concerns the support a child receives. Some entries can record a disability, Section 504 status, the main type of disability, and accommodations during tests. Others can hold English proficiency data, test registrations and results. A record may also show whether the child falls under Title I, McKinney-Vento or a military-family category.
CDE's notice rules out Social Security numbers, account passwords, and bank or payment card details. It also says information about parents and guardians was not involved. That limits some kinds of fraud. It does not make the data harmless, because much of it describes children's health, learning and family circumstances.
The lesson: the vendor holds your risk
This shows a pattern in how institutions think about security. The school system and the state were not the place where the data was taken. A contractor's transfer site was. Yet the families affected will hear about it from the state, and the state answers for it.
A transfer site is also easy to overlook. It is not a customer-facing product. It rarely appears in a board risk report. But it can hold files from several years and several programs. When one login opens that much, the login is worth as much as the data behind it.
The timeline adds a second lesson. The access window opened in late spring, and ETS spotted the activity on September 25. CDE wrote to district leaders on October 2. Family notifications began October 16 and are expected to continue into early November. SecurityWeek does not say why detection took that long. It is the right question to ask of any partner.
Questions to put to your team
Start with an inventory. Which vendors run file transfer sites that hold your data? Who owns each login, and what protects it beyond a password?
Then ask about retention. How much history sits on each site, and does it need to? A site that holds only what is in transit exposes far less than one that holds years of files.
Finally, ask about visibility. Would you know if a valid login was used at unusual times? Does your contract require the vendor to tell you, and how quickly? Ask for evidence, not reassurance.
The credential was the key, but the lesson is about the building. Data you share is data you still own the risk for.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: SecurityWeek.
