California student data breach at testing vendor ETS started with one stolen login

The California student data breach disclosed this month could touch millions of families, and it started with a single stolen login. According to the California Department of Education (CDE), an unauthorized party used a compromised credential to get into a file transfer site run by Educational Testing Service (ETS), the nonprofit that handles California's statewide tests, and copied student files over nearly four months. Notification letters started going out on October 16, and CDE expects them to keep arriving into early November.

No official victim count has been released. But the scope described in the state's own notice is huge: records on students enrolled in California public schools over the past three school years, plus some former students going back to 2006. CDE counts more than 5.7 million students in the public school system this year alone, which gives a sense of how many families could be pulled in.

What happened in the California student data breach

ETS works under contract with the state to run mandated assessments, including the CAASPP and ELPAC programs. To move testing data back and forth with CDE, it used a secure file transfer protocol (SFTP) site. That site is where the trouble was.

Here is the timeline the state has published:

• May 22 to September 18, 2026: an unauthorized party used a compromised login credential to access the SFTP site and copy student files.
• September 25, 2026: ETS spotted unauthorized activity and shut the affected account down.
• October 2, 2026: CDE sent a letter to county and district superintendents and charter school leaders.
• October 16, 2026: letters to students and families began.

ETS took the site offline, brought in outside cybersecurity experts and worked with law enforcement. According to CDE, ETS is building a replacement site with stronger protections and paused regular processing of enrollment data and some testing work while its systems were reviewed. ETS also said web monitoring has so far found no sign that the files have been posted publicly.

What the notices do not say is just as important. As SecurityWeek pointed out in its report, neither CDE nor ETS has explained how the login was compromised, and no attacker has been named.

Why one password mattered so much

A single account was able to reach files covering millions of students for close to four months. That is the part security teams will focus on. Stolen credentials remain one of the most common ways into organizations, and file transfer servers have been a favorite target because they often hold bulk data in one place. We saw a similar pattern of one weak link causing wide damage in the BAE Systems incident that knocked out the federal Bankruptcy Noticing Center.

What student data was exposed

Not every record holds the same fields, but according to the CDE incident page, the copied files may include:

• Student name, date of birth, home address, school, district and grade level
• The Statewide Student Identifier (SSID) and local student ID
• Demographic details such as gender, race or ethnicity, primary language, country of origin and English learner status
• Disability and Section 504 status, primary disability type and testing accommodations
• Eligibility for programs such as Title I, McKinney-Vento (for students experiencing homelessness) and military connected student status
• English proficiency data and statewide test registration, participation and results

The state says the files did not include Social Security numbers, driver's license or passport numbers, financial account or card details, or passwords. No parent or guardian information was involved.

That sounds reassuring, and in one sense it is. Without Social Security numbers, it is harder for criminals to open credit in a child's name right away. But the data that was taken is personal in a way that a card number is not. Disability status, housing status and test results are the kind of details that can be used to make a scam feel real, or to embarrass a family.

Who is affected

According to CDE, the breach covers:

• Current and former students enrolled in California public schools from 2023 through the current school year
• Students who left a California school at any point since 2006 and whose transfer to another school was never confirmed with CDE

That second group means some affected people are now adults. CDE also warns that not getting a letter does not necessarily mean a student was left out, so families should not assume they are in the clear just because the mailbox is empty.

What families should do now

The state and ETS are offering 24 months of free identity protection through Experian IdentityWorks. No credit card is needed. Here is how it works, based on the official FAQ:

Sign up for the free monitoring

• Students under 18: a parent or guardian enrolls the child in IdentityWorks Minor Plus.
• Students 18 and older: enroll in the adult IdentityWorks plan.
• Deadline: March 19, 2027. The activation code is printed in the notification letter.
• Identity restoration help is available for 24 months from the date of the notice, even if you do not sign up for monitoring.

If you have questions, the call center is 833 931 8488, Monday through Friday, 6 a.m. to 6 p.m. Pacific time (TTY users can dial 711). CDE lists the engagement number B174774 for students under 18 and B174775 for students 18 or older.

Watch out for scams that use this breach

This is where most of the real risk sits. Expect fake emails, texts and calls that mention your child's school, state testing or "the ETS incident." CDE's advice is simple: do not hand over Social Security numbers, passwords or bank details to anyone who contacts you out of the blue, and check that a website address is real before typing anything in. Our guide on how to spot fake accounts and impersonation scams covers the warning signs, and the same rules apply to email and text.

Consider a credit freeze

Adults can pull free credit reports at AnnualCreditReport.com and place a free security freeze with each of the three bureaus (Equifax, Experian and TransUnion). Parents can also ask for a free freeze for children under 16. A freeze on a child's file is one of the most effective ways to stop someone from opening accounts in their name years before they ever apply for credit themselves.

It also helps to tighten up the accounts your kids already use. A quick privacy checkup on Facebook, Instagram and other apps limits how much extra information a scammer can stitch together with what was leaked.

Why it matters beyond California

School systems collect a lot of data and rarely hold it themselves. Testing, attendance, learning apps and grading often run through outside vendors, each with its own servers and logins. When one vendor gets breached, the school district may have done nothing wrong and still end up with millions of affected students.

Settlements and lawsuits often follow large breaches like this one, although nothing has been announced here. If you want a sense of how those cases play out for regular people, our explainer on Cash App breach settlement payments walks through the typical process. You can find more coverage of breaches and security in our tech section.

What to watch next

• A victim count. The state has described who is covered but has not given a number. Breach reports to regulators may eventually reveal one.
• How the login was stolen. Phishing, password reuse or malware on a staff device would each point to different fixes.
• Whether the data shows up online. ETS says it has seen no sign of that yet, and monitoring continues.
• Changes to vendor rules. Lawmakers and school boards may push for tighter security requirements for testing contractors, including multifactor login rules for file transfer systems.

Frequently asked questions

Was my child's Social Security number exposed?

No. According to CDE, the files did not contain Social Security numbers, driver's license or passport numbers, financial details or passwords.

How do I know if my child was affected?

Most families should receive a letter between October 16 and early November. CDE says not getting a letter does not guarantee a student was unaffected, so check the official incident page or call 833 931 8488.

Is the free identity protection worth signing up for?

It costs nothing, needs no credit card and lasts 24 months, so for most families it is worth doing before the March 19, 2027 deadline. Pair it with a credit freeze for the strongest protection.

Who caused the breach?

Officials have not named an attacker or explained how the login was compromised. ETS says it is working with law enforcement on the investigation.