INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

California Students' Records Compromised by Single Exposed Login

| 2026-10-19 11:55 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A breach of Educational Testing Service's (ETS) secure file transfer protocol site exposed millions of California students' records, with unauthorized access dating back to late May 2026 and confirmed on September 25. The compromised entity behind the attack is unknown, but it appears to be a targeted sector within the industry of testing services. More than 5.7 million students were enrolled in California public schools during the affected period, which also included current and former students who left as far back as 2006. The breach involved copying files containing sensitive information such as student names, birth dates, home addresses, school districts, and test registration results, but not Social Security numbers or financial account details. ETS shut down the compromised login credential and pulled the site offline, building a replacement with stronger safeguards in response to the incident, which was discovered by the California Department of Education on October 2, two weeks before family notifications began.
Technical Mitigations AI-generated
• Patch the SFTP site to address potential vulnerabilities in its secure file transfer protocol (SFTP) implementation. • Implement multi-factor authentication for all login credentials used by ETS and CDE. • Conduct a thorough investigation into how the login credential was compromised, including reviewing logs and network activity.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
FIVE_EYES FIVE_EYES educationeducation
Incident Timeline
‎May 22, 2026
An unauthorized party used a compromised login credential to access and copy files containing California student information from May 22, 2026 to September 18, 2026.
industry Education
General Document Context
‎September 18, 2026
Threat actors used a compromised login credential to access the SFTP site and copy files containing California student information between May 22, 2026, and September 18, 2026.
industry Education
General Document Context
organisation FAQ
The department’s incident FAQ notes that the impacted population also extends to students who left a California school as far back as 2006 and whose transfer to another school was not confirmed with CDE.
organisation Social Security
The notice says the files did not contain Social Security numbers, passwords, or financial account or payment card details.
organisation SFTP
ETS shut down the account the intruder used and pulled the SFTP site offline.
‎September 25
Threat actors used phishing to target the organization's site, with unauthorized activity detected on September 25.
‎October 2
CDE informed county and district superintendents and charter school administrators of the incident in a letter dated October 2.
‎October 16
Student notifications began being sent on October 16 regarding a compromised login that exposed millions of California students' records.
‎2025-2026
Threat actors accessed and copied information about California students, including all enrolled in the three previous school years.
general_metric 5.7 students
No victim count has been provided, but the notice says, “Information about California students, including but not limited to all students enrolled in the three previous school years, was accessed and copied.” CDE’s own enrollment figures put that in perspective: more than 5.7 million students were enrolled in California public schools in 2025-2026.
‎2026/10/19
Threat actors exploited a file transfer system vulnerability to copy millions of California students' records.
organisation California Students’ Records
One Compromised Login Exposed Millions of California Students’ Records.
organisation Educational Testing Service
Personal information on current and former California public school students was copied from a file transfer system belonging to Educational Testing Service (ETS), according to the California Department of Education (CDE).
organisation CDE
Personal information on current and former California public school students was copied from a file transfer system belonging to Educational Testing Service (ETS), according to the California Department of Education (CDE).
organisation ETS
ETS is a nonprofit that handles state and federally mandated testing under a contract with the state.
Intelligence Sources
SecurityWeek 2026-10-19