California Department of Education: its statewide assessment contractor ETS had an SFTP site breached from 22 May to 18 September with a stolen login, exposing data on all students enrolled in California public schools over the past three school years, including disability status and test results
The California Department of Education (CDE) said on 16 October 2026 that ETS, the nonprofit assessment organisation that runs California's statewide student assessments (CAASPP and ELPAC), has begun notifying students and families of a data breach. According to the ETS notice published by CDE, ETS found unauthorised activity on 25 September on a secure file transfer protocol (SFTP) site used to exchange statewide assessment information with CDE; an unauthorised party had used a compromised login credential at various times between 22 May and 18 September 2026 to copy files of California student information. Data on all students enrolled in the three previous school years was accessed and copied, as well as some former students, and may include names, dates of birth, home addresses, schools, districts and grade levels, statewide and local student identifiers, gender, race or ethnicity, primary language, country of origin and English learner status, disability and Section 504 status, assessment accommodations and primary disability type, eligibility for Title I, McKinney-Vento (homeless) and military-connected programs, and English proficiency and assessment results. More than 5.7 million students were enrolled in California in the 2025 school year. Social Security numbers, licence and passport numbers, financial and card details, passwords and parent or guardian information were not involved. ETS disabled the account, took the SFTP site offline and built a new one, paused normal enrolment data processing and some assessment activities, and says it has taken steps with law enforcement and cybersecurity experts to reduce the risk of the data being published and has found no sign so far that it has been. No group has claimed the attack. Notices began on 16 October and will continue into early November, in 27 languages, with two years of free Experian IdentityWorks identity protection. CDE says it is reviewing ETS's compliance with its data-security and contract requirements. Primary: CDE news release and ETS notice (16 Oct); wire: The Record (20 Oct).
- Product
- ETS-operated SFTP site used for California statewide student assessment data (CAASPP, ELPAC)
- Versions
- n/a — contractor data breach
- Exploited in Australia?
- unknown
- Patch to
- Affected California families: enrol students in the free Experian IdentityWorks service offered in the notice, and treat calls, emails or texts that quote a child's school, student ID or disability details as possible scams. Australian schools and education departments: review file-transfer sites run by assessment and edtech contractors for single-factor logins, require MFA and IP allow-listing on SFTP accounts, alert on bulk downloads, and confirm contracts let you audit vendors' security.
Primary: California Department of Education — ETS begins notifying California students and families following data security incident (16 Oct 2026) · Vendor: CDE — ETS Notice of Data Breach (incident notices, 27 languages) · The Record — California warns all public school students of data stolen in contractor breach (20 Oct 2026)