The California Student Data Breach by the Numbers: Four Months, Three School Years and One Stolen Login
A single compromised login let an intruder copy California student records from a testing contractor’s file-transfer site for nearly four months. The key figures, and what they teach every business that shares data with vendors.
California’s Department of Education announced on Friday that an intruder copied student records from a file-transfer site run by Educational Testing Service (ETS), the nonprofit that administers the state’s standardized tests. Families began receiving letters the same day.
The figures below come from Reuters’ report on the department’s announcement, with added detail from Cybernews and the official ETS notice filed with the California Attorney General.
The numbers
1 compromised login
The investigation found that an unauthorized party used one compromised credential to sign in to an ETS secure file transfer protocol (SFTP) site that the testing company and the state used to exchange assessment data.
Nearly 4 months of access
The intruder copied files at various times between May 22 and September 18, 2026. ETS spotted the activity on September 25, disabled the account, took the site offline, and brought in outside investigators.
3 school years
The data covers, at minimum, every student enrolled in the three previous school years. Cybernews reports that some former-student records date back to 2006. For scale, the department says more than 5.7 million students were enrolled in the 2025–2026 school year alone.
More than a dozen kinds of data
Depending on the student, the copied files may include name, birth date, home address, school, district, grade, state and local student ID numbers, gender, race or ethnicity, primary language, country of origin, English learner status, disability and Section 504 status, testing accommodations, eligibility for certain federal programs, and test registration and results.
0 Social Security numbers
According to the notice, the files did not include Social Security, driver’s license or passport numbers, financial account or card details, passwords, or any parent or guardian information. ETS says it has found no sign so far that the data has been posted publicly.
2 years of identity protection
ETS is offering affected current and former students two years of free identity-protection services, with separate packages for minors and adults. The enrollment deadline is March 19, 2027. Cybernews reports that notifications are expected to continue into early November.
1 brand-new file-transfer site
ETS says it rebuilt the SFTP service from scratch with stronger controls and has added monitoring, tighter access controls and outside reviews. State agencies, including the California Cybersecurity Integration Center, are assisting, and the education department says it is reviewing whether ETS met its data security and contract obligations.
What this means for your company
This was not an exotic exploit. It was one password-protected account on a file-exchange server, used quietly for months. If your business swaps files with clients, payroll providers, insurers or government agencies over SFTP or a shared portal, ask three questions this week: Does every account on it require multi-factor authentication or key-based login? Are old files purged on a schedule instead of piling up for years? And would anyone notice a familiar account downloading far more than usual? Expect phishing that name-drops schools or testing, too; the notice itself warns families to distrust unexpected calls and emails about the incident.
Need help locking down the file-transfer accounts you share with clients and vendors? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
