A third-party testing vendor for California public schools lost control of student records for four months, and the fallout now reaches millions of families across the state.

The breach struck a Secure File Transfer Protocol system operated by Educational Testing Service, known as ETS, which handles student information for the California Department of Education. Attackers moved through that system repeatedly between May 22 and September 18, copying files filled with names, home addresses, dates of birth and student identifiers. The activity went undetected until September 25.

What You Need to Know

The compromised data belongs to current and former students in California public schools, not to a private company's customers. Because Social Security numbers and student IDs often anchor financial aid, tax filings and school enrollment, stolen education records carry long-term identity risk. ETS and the California Department of Education are notifying affected individuals and offering 24 months of free identity protection. Investigators have found no evidence that the data has been published or that a ransom demand was made.

How the ETS Breach Unfolded

The attack did not exploit a software flaw. Investigators believe the intruders used compromised credentials to enter the file transfer environment, according to reporting from Malwarebytes. That detail places the incident squarely in the category of human vulnerability rather than a patching failure.

Once inside, the attackers returned again and again over roughly four months. Each visit allowed them to access and copy student files, suggesting the environment lacked detection capable of flagging repeated unauthorized transfers.

Scale of the Exposure

Neither ETS nor the California Department of Education has confirmed an exact victim count. State figures show more than 5.7 million students were enrolled in California public schools during the 2025-2026 academic year alone.

Officials believe students who enrolled over the previous three years could be affected. If each year carried a similar enrollment total, the exposure could approach 17 million records.

5.7 million

Students enrolled in 2025-2026

24 months

Free identity protection offered

Why This Matters

School districts across California now face a notification and remediation burden that will stretch well beyond the current academic term. Families whose children attended public schools in the past three years must treat their personal data as potentially compromised, even if no letter has arrived yet.

The incident also reshapes how state agencies evaluate outside vendors. Contracts that once treated student data handling as routine procurement now carry reputational and legal exposure, and ETS will face pressure to demonstrate that its enhanced monitoring and access controls close the gap that allowed repeated intrusions.

For the broader education technology sector, the breach reinforces a hard lesson. Third-party providers sit inside the trust boundary of public institutions, and a single set of stolen credentials can expose a population larger than most U.S. states.

What You Need to Know About the Response

ETS and the California Department of Education are jointly contacting affected individuals. Those notifications include access to identity protection services at no cost for two years.

The company has outlined several steps it says are already in motion. According to a statement provided to Reuters, ETS described the measures as follows:

  • Enhanced monitoring: Additional oversight of systems holding student records.
  • Strengthened access controls: Tighter restrictions on who can reach sensitive files.
  • Third-party review: Outside assessment of the organization's security practices.

No evidence has surfaced that the stolen information has been publicly released. Investigators also have not reported a ransom threat connected to the incident.

The timeline remains a concern for security analysts. Four months passed between the first unauthorized access and its discovery, a window that gave attackers ample opportunity to copy and recopy student records.

The Bigger Picture for School Data Security

Education records occupy an unusual position in the data economy. They are created for children, retained for decades and rarely protected with the same intensity as financial or healthcare data.

That combination makes school systems attractive targets. A student's name, address and date of birth can support synthetic identity creation for years before anyone notices a problem.

State education departments increasingly rely on outside vendors for testing, analytics and record management. Each partnership expands the attack surface, and each credential becomes a potential entry point.

The California case may accelerate demands for stricter vendor audits and faster breach detection requirements in public education contracts nationwide.