California Warns Millions of Public School Students Following ETS Data Breach

A months-long intrusion into Educational Testing Service (ETS) file transfer servers has compromised the personal, demographic, and academic records of millions of California K-12 public school students across three school years. The breach, which affected the primary assessment contractor for the California Department of Education (CDE), involved unauthorized access to student records exchanged between ETS and state education authorities.

Unauthorized Access to ETS File Transfer Infrastructure

Between May 22 and September 18, threat actors gained unauthorized access to a secure file transfer protocol (SFTP) platform managed by Educational Testing Service, the vendor responsible for administering California’s statewide standardized testing. During this nearly four-month dwell time, attackers repeatedly copied extensive batches of student records transferred between ETS and CDE systems.

ETS discovered the intrusion on September 25 and disabled the compromised account used to exfiltrate the data. To contain the incident and secure its supply chain, ETS subsequently pulled the entire file transfer site offline and constructed a new platform to replace the compromised environment. While no ransomware group or threat actor has publicly claimed responsibility for the attack, the intrusion aligns with ongoing threat patterns targeting Managed File Transfer (MFT) platforms and SFTP endpoints. Web-facing file transfer systems are prime targets for cybercriminals because they serve as central aggregation points where bulk datasets are temporarily staged and routinely synchronized across organizational boundaries.

Scope of Impact and Exposed Student Data

The California Department of Education breach impacts current and former K-12 public school students enrolled in California between 2023 and the 2025 school year—a system that enrolls over 5.7 million students annually—as well as students who departed a California school as far back as 2006 without CDE confirming a transfer to another educational institution.

The exfiltrated files contained broad and sensitive categories of student records, including:

• Identifying and Demographic Data: Full student names, dates of birth, residential addresses, school and district assignments, grade levels, Statewide Student Identifiers (SSID), local student identifiers, gender, race or ethnicity, primary language, country of origin, and English learner status.
• Special Education and Accommodations: Disability status, Section 504 status, designated testing accommodations, and primary disability types.
• Sensitive Program Enrollments: Eligibility status for Title I (Part A and Part C), McKinney-Vento assistance for homeless youth, and Military Connected Student status.
• Academic Performance: English language proficiency metrics, statewide assessment registrations, exam participation records, and test results for the California Assessment of Student Performance and Progress (CAASPP) and English Language Proficiency Assessments for California (ELPAC) exams.

Exposing personally identifiable information (PII) belonging to minors creates long-term identity theft risks. Unlike adults who actively monitor credit reports and bank accounts, K-12 students rarely check their credit histories before reaching adulthood. Fraudulent activity—such as synthetic identity creation, unauthorized line-of-credit openings, or fraudulent benefit claims using stolen SSIDs and dates of birth—can remain undetected for years. Furthermore, specialized fields like McKinney-Vento homeless status or disability designations introduce severe privacy risks if leaked publicly.

Systemic Supply Chain Risks in K-12 Education

This incident highlights the systemic blast radius associated with third-party software and assessment vendors in the educational sector. State education agencies regularly outsource specialized operations—ranging from learning management systems to standardized testing administration—to external contractors. When these vendors ingest bulk demographic and assessment feeds, a single security lapse in a vendor’s file transfer software or service credential can compromise an entire state’s student population.

ETS is not the first major educational vendor to suffer a large-scale data exposure; edtech and service providers including PowerSchool, Instructure, McGraw Hill, and Illuminate Education have faced similar breaches in recent years. Cybercriminals recognize that educational service providers manage massive, highly structured databases containing PII for millions of individuals but often lack the uniform security controls found in financial or healthcare enterprises.

Current Response and Operational Impact

Following the discovery, CDE and ETS notified law enforcement and engaged cybersecurity experts. CDE confirmed that ETS has taken steps to mitigate the risk of the exfiltrated dataset being made public, though specific technical details regarding those measures have not been publicly disclosed. Dark web and web monitoring conducted by ETS has uncovered no evidence that the stolen files have been published or offered for sale.

CDE began notifying affected families on October 16 and expects notification distribution to continue through November. In response to the breach, ETS halted normal enrollment data processing and temporarily paused select testing activities while its infrastructure undergoes comprehensive security assessments. CDE is reviewing ETS’s compliance with state data security standards and contractual requirements while working to minimize testing disruptions for California schools.

Organizations managing state or educational data transfers should immediately audit all public-facing SFTP and MFT endpoints, enforce least-privilege access on transfer accounts, mandate multi-factor authentication (MFA) on interactive transfer logins, and implement strict data retention schedules to ensure staging files are purged immediately after automated processing completes.