ETS SFTP breach exposes California student data via stolen logins
Personal information belonging to millions of current and former California public school students was stolen from a system run by Educational Testing Service (ETS), according to Malwarebytes. The California Department of Education (CDE) is distributing ETS’s breach notice, and ETS says it has found no evidence so far that the data has been made public.
What we know
The reporting describes a breach of an ETS-operated secure file transfer protocol (SFTP) site. ETS is a nonprofit that helps run the state’s standardized tests under contract with CDE.
- An investigation determined that an unauthorized party used compromised login details to access the site.
- Files containing California student information were copied at various times between May 22 and September 18.
- ETS, at CDE’s direction, has begun notifying students and families.
- The attacker, the source of the login details and the exact number of affected people have not been disclosed.
Who is affected
CDE says the breach includes all students enrolled during the previous three school years, and that the affected population is not limited to that group. For scale, CDE reports that over 5.7 million students were enrolled in California public schools during the 2025-2026 school year alone.
The information involved varies by individual and may include:
- Student names and Statewide Student Identifiers (SSIDs)
- Dates of birth and home addresses
- Demographic information
- Disability and program participation information
- Statewide assessment information, including test scores
Not every affected student had every category exposed. CDE says Social Security numbers, financial account information, passwords and parent or guardian information were not involved.
Why this matters
Analysis, not new facts: the absence of Social Security numbers lowers the risk of classic financial fraud, but this data is still sensitive. Disability and program information plus home addresses and dates of birth give scammers believable material for targeted phishing aimed at families, and children’s records stay useful to abuse for years.
For security teams, the incident also fits a familiar pattern: a file-transfer endpoint at a contractor, reached with valid credentials rather than an exploit. The reported window of May 22 to September 18 suggests access went unnoticed for months. The sources do not say whether multi-factor authentication was in place on the SFTP site, so we do not know.
What has not been confirmed
- How the login details were obtained.
- Who is responsible and whether data is being sold or leaked. ETS only says it has found no evidence so far of publication.
- The total number of people whose records were copied.
What to do
If you are a student, parent or guardian:
- Follow the instructions in the notification you receive, and verify any message about the incident through official channels.
- Consider enrolling in the two years of free identity-protection services. Parents or legal guardians can enroll affected minors, and affected adults can enroll themselves.
- Treat unsolicited messages that mention your child or their school with suspicion.
- Never share passwords, security codes or payment details in response to an unsolicited message or call.
If you run IT or security for a school, district or vendor:
- Inventory SFTP and other file-transfer endpoints that hold student or customer data, including those run by contractors.
- Require multi-factor authentication or key-based access, and rotate credentials that have not changed recently.
- Review authentication logs for logins from unfamiliar locations or times, and for bulk file downloads over long periods.
- Alert staff and families to expect phishing that uses real student details, and tell them how official notices will be delivered.
