An attacker repeatedly used a compromised login to copy California student records over nearly four months before testing provider Educational Testing Service discovered the breach.
The incident affected a file-transfer system operated by Educational Testing Service (ETS), which works with the California Department of Education on statewide testing programs.
The Los Angeles Times reported that ETS identified the incident on Sept. 25, after unauthorized activity spanning May 22 to Sept. 18. The duration raises questions about how the activity went undetected and whether existing access controls and monitoring were sufficient to flag the copying of sensitive records.
A single trusted credential exposed millions of schoolchildren
One account carried enough trust that breaching it exposed sensitive data belonging to millions of California public school students.
According to the California Department of Education, the attacker used a compromised login credential to access an ETS file-transfer site and copy student records, exposing information belonging to both current and former students.
An exact count of affected individuals has not been published. For context, California enrolled more than 5.7 million public school students in 2025–2026, but that figure is not a confirmed breach total. The affected population includes current and former students enrolled from 2023 through the current school year.
The affected population also includes students who left a California school since 2006 whose transfer to another school was not confirmed with CDE.
According to CDE, the information accessed and copied varied by individual but could include students’ names, dates of birth, home addresses, statewide student identification numbers, school and district details, demographic information, disability status, eligibility for certain assistance programs, and assessment records.
However, the breach did not expose Social Security numbers, financial account information, passwords, or personal information belonging to parents and guardians.
The longer a breach goes undetected, the greater the risk
Unauthorized access to the ETS student records began May 22, 2026, but the provider did not discover the breach until Sept. 25, a week after the last identified access. The incident follows a separate Infinite Campus breach involving school staff accounts. That gap matters because an organization cannot respond to a compromise it has yet to detect, leaving stolen data and potentially unauthorized access unaddressed while the intrusion remains undiscovered.
Although officials have reported no evidence that the stolen student information has been made public, that does not mean the data has not been misused or passed on privately.
For organizations, the risk extends beyond the information stolen in a breach to how long attackers can operate without detection, and how much time that gives them to access, copy, or potentially misuse sensitive data.
As attackers become more adept at stealth, defenders need to detect these activities faster before they go unnoticed for extended periods. The ETS incident is one reminder that preventing unauthorized access is only one part of security.
ETS disabled the compromised account, took the affected file-transfer site offline, and began investigating with external cybersecurity experts. CDE says ETS has also built a replacement site with enhanced security controls.
Public disclosures have not explained how the credential was compromised or identified the attacker.
What is the way forward?
For affected California students, officials say they are eligible for 24 months of free identity-protection services.
Schools have been notified, and students and families should follow the official notification instructions to access the service. Affected parties should stay alert for unsolicited messages claiming to come from their schools or education authorities, even if they arrive long after the incident.
For security teams, the incident raises practical questions about account permissions, file-transfer monitoring, and oversight of vendors holding sensitive records. The public disclosures do not establish which specific controls failed at ETS, but organizations can use the incident to review their own exposure.
Start by checking which human and service accounts can retrieve sensitive files, whether they need access to the full dataset, and whether inactive permissions can be removed. Limit access to the records and systems each account requires, and use multi-factor authentication where supported to make stolen credentials harder to exploit.
Monitoring should cover file activity as well as sign-ins. Security teams should investigate unusual download volumes, repeated transfers, and access inconsistent with an account’s normal work, with a clear process for disabling suspicious accounts.
Organizations sharing data with vendors should also establish who reviews access logs, investigates alerts, and communicates incidents. The practical goal is to reduce both the information a compromised account can retrieve and the time unauthorized activity can continue.
Read more: Compromised logins can expose sensitive information across industries, as the ASOS breach involving employee credentials and customer data illustrates.