ETS SFTP Breach Exposes Millions of California Student Records

A single compromised login credential on a secure file transfer protocol (SFTP) server managed by the Educational Testing Service (ETS) allowed unauthorized actors to steal sensitive records belonging to millions of California public school students. The breach, disclosed by the California Department of Education (CDE), compromised testing and demographic data spanning back to 2006. The ETS data breach highlights the enduring vulnerability of legacy file transfer infrastructure when identity controls like multi-factor authentication (MFA) or network access boundaries are bypassed or absent.

Discovery and Intrusive Timeline

The incident centers on an SFTP platform operated by ETS, a nonprofit vendor contracted by the state of California to administer state- and federally mandated testing programs, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).

According to official breach documentation released by the CDE, an unauthorized intruder leveraged valid, stolen credentials to gain entry to the server. The malicious activity remained undetected for nearly four months:

• May 22: The intruder first accessed the SFTP site using the stolen account.
• September 18: The attacker’s final recorded session on the file server occurred.
• September 25: ETS security personnel detected unauthorized activity on the SFTP environment and initiated an incident response investigation.
• October 2: CDE notified county and district superintendents, alongside charter school administrators, instructing ETS to pause routine enrollment data processing and suspend selected assessment services.
• October 16: Official notifications to impacted families began rolling out, with mailing timelines expected to extend into early November.

While ETS has not disclosed the precise mechanism used to harvest the login credential—such as a targeted phishing campaign, credential stuffing, or infostealer malware infection on an endpoint—the unauthorized party enjoyed prolonged, intermittent access without triggering automated access alerts or anomalous velocity checks.

Blast Radius and Exposed Data Fields

Although official disclosures have not cited an exact total of affected individuals, the scope is massive. California public schools enrolled over 5.7 million students during the 2025–2026 academic year alone. However, because the compromised SFTP directory hosted legacy data, the breach extends to former students who left the California public education system as far back as 2006 whose unconfirmed transfers left active historical records in CDE systems.

The stolen files contained extensive personally identifiable information (PII) and specialized educational status records. Stolen data points include:

• Full names, dates of birth, home physical addresses, gender, race or ethnicity, primary spoken language, and country of origin.
• State and local student identification numbers, school district identifiers, and enrolled grade levels.
• Highly sensitive educational classification data, including disability and Section 504 status, primary disability type, required testing accommodations, and English learner status.
• Academic assessment history, including test registration details, raw scores, and performance levels.
• Program eligibility flags, such as Title I status, McKinney-Vento (homeless student) status, and military-connected student designations.

The CDE confirmed that Social Security numbers, system passwords, financial account numbers, payment card details, and parent/guardian contact records were not included in the compromised SFTP files.

The SFTP Vulnerability Pattern in Education Tech

SFTP servers and managed file transfer (MFT) systems remain high-value targets for cybercriminals due to the density of unencrypted, aggregated bulk data they house. External vendors and state agencies routinely rely on SFTP as an operational “data pipeline” to sync large datasets between internal databases. When these systems rely solely on static username-and-password pairs or unmonitored service credentials, a single compromised identity compromises the entire operational repository hosted on that server.

In this instance, the exposure of minor PII coupled with specialized medical and socioeconomic classifications (such as Section 504 accommodation details and McKinney-Vento markers) creates significant secondary risk. While direct financial fraud against primary account holders is mitigated by the absence of financial details, bulk student datasets are frequently weaponized in spear-phishing campaigns, extortion attempts against school districts, or long-term identity theft where a minor’s clean credit profile is exploited years down the line.

Incident Mitigation and Defense Steps

Following the discovery of the intruder on September 25, ETS executed immediate containment steps by revoking the affected user account and taking the SFTP site offline entirely. ETS is currently building a replacement file transfer architecture featuring updated security controls.

To reduce downstream exposure, ETS worked alongside federal law enforcement agencies and third-party incident response firms. While ETS reported that external web and dark web monitoring has not uncovered public dumps of the stolen datasets, the organization is offering two years of complimentary identity protection and credit monitoring services to all affected current and former California students.

Organizations managing vendor file transfer infrastructure should take immediate defensive actions to prevent similar credential-based exfiltration:

• Enforce phishing-resistant Multi-Factor Authentication (FIDO2/WebAuthn) on all external-facing SFTP, FTPS, and MFT endpoints, removing single-factor password access entirely.
• Implement strict network segmentation and access policies, restricting file transfer server logins to trusted source IP blocks using perimeter firewalls or Zero Trust Network Access (ZTNA) gateways.
• Configure automated log alerts to trigger on anomalous file download volumes, off-hours logins, or connections originating from unfamiliar geographic locations or residential proxy networks.
• Enforce automated data retention and purge policies on transient file transfer hosts so that legacy student datasets dating back multiple years are systematically deleted once processing transfers complete.