California Students Must Verify Breach Notices After ETS Data Theft
Unauthorized access to an Educational Testing Service file server exposed sensitive education records for millions of California public school students.
Key points
- Hackers used stolen login credentials to access a secure ETS file transfer site between May and September.
- Exposed data includes disability information and test scores for students enrolled in the last three school years.
- Social Security numbers and financial account details were not part of the stolen files according to the California Department of Education.
An unauthorized party accessed a secure file transfer protocol site operated by Educational Testing Service, stealing personal information belonging to millions of current and former California public school students. The California Department of Education confirmed the breach after ETS, a nonprofit contractor that helps administer state standardized tests, detected the intrusion. The department is now distributing breach notifications to help affected families understand the incident and access available resources.
Root cause
Investigation results indicate that the attackers gained entry to the ETS system by using compromised login details. This credential theft allowed them to access the secure file transfer site. The unauthorized access occurred at various times between May 22 and September 18. During this window, the threat actors were able to copy files containing sensitive student information.
Attack path
The attackers used the compromised credentials to access the site and copy files containing California student information. The scope of the breach covers all students enrolled in California public schools during the previous three academic years, although the affected population is not strictly limited to that group. The California Department of Education noted that over 5.7 million students were enrolled in the 2025–2026 school year alone, highlighting the scale of the potential exposure.
Affected versions
The incident involves the specific secure file transfer protocol site managed by Educational Testing Service for the California Department of Education. No specific software version numbers or CVE identifiers have been released in the public notifications. The breach affects the data repository rather than a publicly traded software product with versioned updates. The exposure varies by individual student record, meaning not every affected person had every category of information compromised.
Mitigation
- Verify all communications regarding the breach through official channels provided by the California Department of Education or ETS.
- Enroll in the two years of free identity-protection services offered to affected individuals.
- Monitor accounts for unusual activity, especially those linked to educational institutions or testing services.
- Do not share passwords, security codes, or payment details in response to unsolicited messages about the breach.
For customers and users
Affected students and families should treat this breach as a high-risk credential exposure event. Phishing attacks often follow data leaks, using stolen personal details to craft convincing messages. Check whether any communication requests immediate action or financial information. Teams usually advise verifying sender addresses and contacting institutions directly through known official websites rather than clicking links in emails. Avoid sharing security codes or payment details with anyone who contacts you unexpectedly about this incident.
Background: Credential exposure
Credential exposure occurs when login identifiers and secrets become accessible to unauthorized parties. This happens through breaches, leaks, or weak storage. It allows attackers to impersonate you, access accounts, and pivot into broader networks without needing to break new encryption.
Read the full guide: Credential Exposure: Meaning, Sources, and Real-World Impact
What to do and how to stay safe: Educational Testing Service
- Check your email spam folder for legitimate breach notifications from Educational Testing Service or the California Department of Education.
- Update passwords for any accounts that share the same credentials used for school or testing portals.
- Enable multi-factor authentication on all personal and educational accounts to add a layer of security beyond passwords.
- Monitor credit reports and educational account statements for unauthorized changes or new inquiries.
Step-by-step guide: Unauthorized Access Prevention Checklist for Systems
General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific types of data were stolen in this breach?
The stolen files may include disability and program participation information, as well as statewide assessment information and test scores.
Were Social Security numbers or financial details compromised?
No, the California Department of Education stated that Social Security numbers, financial account information, passwords, and parent or guardian information were not involved.
How can I get protection after my data was stolen?
Affected individuals can enroll in two years of free identity-protection services; parents can enroll minors, while adults can enroll themselves.
