A single stolen login credential gave an unauthorized party access to sensitive records for California public school students. Educational Testing Service (ETS), which runs state testing programs including CAASPP and ELPAC, discovered the breach on September 25 — but the credential had been used at various times to copy files since May 22, with the last access on September 18.
The files came from an SFTP site ETS shared with the California Department of Education. No victim count has been given. The department says the data covers students enrolled from 2023 onward, plus anyone who left a California school since 2006 without a confirmed transfer elsewhere — and more than 5.7 million students were enrolled in 2025-2026 alone.
Stolen data includes names, birth dates, addresses, Statewide Student Identifiers, disability status and Section 504 status, testing accommodations, and test results, though not every student had every category exposed. Social Security numbers, passwords, and financial details were not in the files, and parent information wasn’t involved.
ETS disabled the account, pulled the site offline, and built a replacement. How the credential was stolen and who used it remain unknown, though ETS says its web monitoring has found no sign the data has been published. CDE and the State Board of Education are now reviewing whether ETS met its security and contractual obligations. Notification letters started going out on October 16 and continue into early November.
Source: SecurityWeek
