Millions of California Students' Data Compromised in ETS SFTP Breach
Sensitive personal and academic data of millions of California students was stolen from an Educational Testing Service (ETS) SFTP site due to compromised credentials.
Millions of current and former California public school students have had their sensitive personal and academic information stolen from a secure file transfer protocol (SFTP) site operated by Educational Testing Service (ETS). ETS, a non-profit organization contracted by the California Department of Education (CDE) to administer standardized tests, has begun notifying affected individuals about the breach.
The investigation revealed that an unauthorized party gained access to the SFTP site using compromised login credentials. This illicit access occurred intermittently between May 22 and September 18, during which time the attacker was able to copy files containing student data. The California Department of Education is assisting ETS in distributing breach notices to ensure affected students and their families receive timely information and access to resources.
The compromised data potentially impacts all students enrolled in California public schools over the last three academic years, though the affected population is not strictly limited to this group. The specific information exposed varies for each individual but may include student names, Statewide Student Identifiers (SSIDs), dates of birth, home addresses, demographic details, information related to disabilities and program participation, and statewide assessment scores.
While the breach is significant, CDE has clarified that Social Security numbers, financial account information, passwords, and parent or guardian details were not among the compromised data. ETS has also stated that there is currently no evidence to suggest that the stolen information has been publicly released by the unauthorized party.
Given the scale of student enrollment in California, with over 5.7 million students in the 2025-2026 school year alone, the potential scope of this breach is vast. The exposed files contain highly personal information that could be used for identity theft or other malicious purposes, particularly concerning details about students' educational progress and any disclosed disabilities.
ETS, under the direction of CDE, is offering two years of free identity-protection services to all affected individuals. Students, parents, or legal guardians are encouraged to follow the instructions provided in the official notification to enroll in these services. It is crucial to verify any communication regarding the incident through official channels and to exercise caution against phishing attempts that may use specific details to appear legitimate.
This incident underscores the persistent risks associated with data storage and access, especially for large educational institutions handling vast amounts of sensitive student information. The use of compromised credentials highlights the ongoing need for robust multi-factor authentication and regular credential management practices to prevent unauthorized access to critical systems.
As a precautionary measure, individuals whose data may have been compromised should remain vigilant for any suspicious activity related to their personal information. Monitoring financial accounts and credit reports, in addition to utilizing the offered identity protection services, is recommended to mitigate potential harm.
The breach, which occurred via a compromised login credential on an ETS SFTP server, potentially exposed data dating back to 2006. While the exact number of affected students is still under investigation, the California Department of Education (CDE) noted that information on students from the past three school years, and potentially earlier, was accessed. The compromised data fields include names, birth dates, addresses, student IDs, and testing results, though Social Security numbers and financial information were reportedly not exposed.