A secure file transfer system has been accessed by an unauthorised individual, using compromised login credentials, and files containing student records have been copied by that individual. During the early morning hours of September 25, 2026, ETS noticed suspicious activity on its secure file transfer protocol server (SFTP), resulting in the discovery of the incident.

A CDE report indicates that multiple instances of unauthorised access occurred between May 22 and September 18, allowing the attackers to gain access to student information for several months before the incident was discovered. It is not known how many individuals were affected by the breach. 

The compromised records, however, contain information about all students registered in California schools over the past three years, and the potential impact extends to students whose records date back to 2006. As of the 2025–2026 academic year, California reported more than 5.7 million students enrolled in its public schools, suggesting that the incident may be of a large scale. This information includes names, dates of birth, home addresses, school and district details, grade levels, and state or local identification numbers for students. 

There may also be information regarding gender, race, ethnicity, primary language, country of origin, and English learner status included in the records. A variety of sensitive educational information, including information regarding disabilities, accommodations for testing, English proficiency, and assessment results, may also be accessed. 

Education databases are under considerable threat from security breaches and compromised credentials pose a number of risks. Although the attacker reportedly used one compromised login to access the system, the breach affected student records maintained by a third-party service provider responsible for handling sensitive student information. Additionally, students with school records going back more than three years are affected by the breach. 

A California Department of Education representative stated that former students who left public schools as early as 2006 may also be affected if their transfer to another school has not been confirmed. Neither the department nor the Department of Education have released a final number of victims, and the information exposed varies from individual to individual. 

Social Security numbers, passwords, financial account information or payment card information were not contained in the stolen records. However, exposing disability-related information, demographic details, and academic results presents privacy concerns, particularly since these records are based on minors. Following the discovery, ETS disabled the account used to access the files and took the SFTP site offline. 

In order to strengthen security, a replacement system is being developed by the organization. Moreover, it has enhanced its monitoring processes, tightened access controls, and arranged additional third-party reviews of its security practices. However, the company has not disclosed how the login credentials were compromised nor identified the attacker. In order to limit the risk that the stolen information might become publicly accessible, ETS has worked with law enforcement and cybersecurity specialists. 

There has been no evidence of the files being published online as of yet, however, the absence of such confirmation does not imply that the data has been deleted or that it will not be abused later. In addition to disrupting education-related operations, ETS suspended routine enrollment processing and paused certain assessment activities while security checks were conducted on its systems.

In a statement issued by the California Department of Education, it stated that it was working to restore affected services and minimize disruption to schools and assessment programs. On October 16, 2026, notification will begin for affected students and families, and will continue throughout early November. In addition to two years of free identity protection services, eligible current and former students can be enrolled by parents or legal guardians. 

There is an increased risk associated with relying on third-party providers to handle large volumes of sensitive educational information, as highlighted by this breach. Although the initial access was linked to compromised credentials rather than a publicized software vulnerability, the incident demonstrates the difficulty in preventing unauthorised activity from occurring when access controls and monitoring fail to prevent access to extensive records. 

It illustrates the potential threats associated with compromised credentials and inadequate access controls in systems that handle sensitive student information. Stronger authentication, continuous monitoring, and regular security reviews remain important in order to protect educational data and prevent similar incidents from occurring again.