California: millions of students’ data stolen via ETS SFTP site

The California Department of Education (CDE) has warned public school students across the state that their personal data was copied from the systems of a contractor: Educational Testing Service (ETS), the non-profit that runs the state-mandated CAASPP (student performance) and ELPAC (English proficiency) tests on the state’s behalf. The attacker did not exploit a vulnerability: according to the CDE notice, as reported by SecurityWeek and The Record, they used a compromised login credential to get in at various times between 22 May and 18 September 2026, into the SFTP site ETS used to exchange testing data with the department.

What happened

ETS spotted the unauthorised activity on 25 September, one week after the last known access and about four months after the first. It disabled the account used by the intruder, took the whole SFTP site offline and is building a new platform with stronger safeguards.

According to SecurityWeek, the CDE informed county and district superintendents and charter school administrators in a letter dated 2 October; notifications to families started on 16 October and will continue into early November. Affected current and former students are offered two years of free identity protection services.

Meanwhile ETS has halted normal processing of enrolment data and paused some testing activities while the security of its systems is assessed. The Record reports that the CDE, together with the state’s cybersecurity experts, is reviewing whether ETS complied with data security and contractual requirements.

How many students and what data

The official notice gives no figure. It refers to information about California students “including but not limited to all students enrolled in the three previous school years”, plus students who left a California school since 2006 without their transfer to another school being confirmed with the CDE. SecurityWeek and The Record point out that more than 5.7 million students were enrolled in the state’s public schools in 2025-2026; DataBreaches.net, quoting early reports, speaks of 7 million students: it is the only source to give that number.

The copied files may contain:

• name, date of birth, home address, school, district and grade;
• Statewide Student Identifier (SSID) and local student identifiers;
• gender, race or ethnicity, primary language, country of origin and English learner status;
• disability and Section 504 status, primary disability type and testing accommodations;
• eligibility for Title I, McKinney-Vento (homeless students) and military-connected student programmes;
• English proficiency, and registration, participation and results of state assessments.

According to the notice, the files held no Social Security numbers, passwords, bank or payment card data, and no information on parents or guardians.

Technical details

• Attack vector: access with valid credentials to an internet-facing SFTP server used as an exchange point between contractor and client. The official disclosures do not explain how the credential was compromised and do not say whether the account was protected by a second factor.
• Duration: repeated access over about four months (22 May–18 September), detected only on 25 September.
• MITRE ATT&CK (our mapping, based on the reported facts): T1078 (Valid Accounts) for initial access and persistence; the files were copied through the same legitimate service. The sources mention no malware.
• Attribution: none. According to The Record, as of Tuesday 20 October no group had claimed the attack.
• Data publication: after working with law enforcement and cybersecurity experts, ETS says it has taken steps to reduce the risk of the data being made public; a CDE spokesperson declined to explain what those steps were. ETS’s web monitoring has so far found no evidence that the data has been published.
• Indicators of compromise: none published.

The Record notes that education service providers are a recurring target, with earlier incidents involving PowerSchool, Instructure, Illuminate Education, McGraw Hill and Kaplan.

Impact for European and Italian companies

The pattern is common in Europe too: a client that hands bulk data to a supplier, and a file exchange point (SFTP or a transfer platform) protected by a single credential, often shared and never rotated, that stays in place for years. Schools, public bodies, healthcare and companies sending data to payroll, testing, logistics or analytics providers face the same risk.

Data such as disability falls within the GDPR’s special categories (Art. 9), and here it concerns minors: for the controller, the fact that the breach happened at the processor is no defence. For NIS2 entities, supply chain security is one of the required risk management measures, and a supplier receiving data in bulk must be assessed and monitored as part of your own perimeter.

What to do now

1. Inventory your file exchange points with suppliers: who runs them, which accounts exist, what data passes through and how long it stays on the server.
2. Strengthen authentication: named accounts for each person or system, SSH keys instead of passwords, a second factor where the service allows it, access restricted to the supplier’s known IP addresses.
3. Rotate service credentials and disable unused ones; check whether your domain’s accounts appear in known breaches.
4. Log and watch downloads: alerts on unusual volumes, night-time activity, new addresses or countries. Four months of access without an alert means these controls were missing or nobody was reading them.
5. Minimise the data: keep only the files you need on the exchange server, and only for as long as needed; no decades-old archives.
6. Review contracts: prompt notification duties, audit rights and minimum security requirements for the exchange point, as required by Art. 28 GDPR.

How ARXDOME helps

ARX Expose flags company accounts involved in breaches and shows ports and services exposed on the internet, SFTP servers included. On monitored servers, the ARX Sentry agent collects logs and security events, and the SOC identity pages show failed logins, use of explicit credentials, night-time logins and account changes; ARX Horizon enriches every connection with country, operator and threat lists.

Last updated: 20 October 2026