INTRUDERS used compromised credentials to access an ETS (Educational Testing Service) SFTP server, copying files containing California student information. The California Department of Education (CDE) says unauthorized activity was detected on 25 September, but access dates stretch back to late May 2026. The breach notice notes that an unauthorized party used a compromised login credential at various times from 22 May 2026 to 18 September 2026 to copy files.
While CDE did not provide a victim count, the notice states that information about California students—including those enrolled in the three previous school years—was accessed and copied. California public school enrolment figures indicate more than 5.7 million students were enrolled in 2025–2026, and the impacted population may also include students who left a California school as far back as 2006 whose transfer to another school was not confirmed with CDE.
Compromised records can include student name, birth date, home address, school, district and grade, state and local ID numbers, gender, race or ethnicity, primary language, country of origin and English learner status; some entries may reveal disability and Section 504 status, primary disability type, testing accommodations, English proficiency data, and test registration and results.
The notice states the files did not contain Social Security numbers, passwords, or financial account or payment card details, and parental/guardian information was not involved. ETS shut down the intruder’s account and offline the SFTP site, replacing it with a more secure system.
They have worked with law enforcement and cybersecurity experts, but the official disclosures do not identify the attacker or how login credentials were compromised; affected students have been offered two years of free identity protection.