Compromised ETS login copied California student records
Original title: One Compromised Login Exposed Millions of California Students’ Records
Access ran from May 22 to September 18, 2026, and the files did not include SSNs or payment data.
The California Department of Education says an unauthorized party used a compromised login to copy student files from Educational Testing Service’s SFTP site used for CAASPP and ELPAC testing data. ETS saw unauthorized activity on September 25; the earliest access was late May. The population includes students from the three prior school years and some records back to 2006, against more than 5.7 million public-school students enrolled in 2025-2026. ETS disabled the account, took the site offline, and says web monitoring has not found the data published.
Unconfirmed: How the credential was compromised, who accessed the site, and the exact number of students are not stated.
- Copied fields can include disability status, test results, and English-learner data.
- Parent and guardian information was not involved, CDE says.
- CDE notified superintendents on October 2; family notices began October 16.
- Affected students can enroll in two years of free identity protection.
- ETS paused some enrollment processing and testing while security was reviewed.
Impact: Student education and personal records were copied
- 1.Eligible students can sign up for two years of free identity protection services.
- ATT&CK
- T1078 Valid Accounts
- Countries
- United States
From the original article
2 min read at securityweek.com
Intruders used compromised credentials to access an ETS SFTP server, copying records of California students back to 2006. The post One Compromised Login Exposed Millions of California Students’ Records appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.