Who’s in it. Per CDE, the files cover all students enrolled in California public schools in the three previous school years, and the affected group isn’t limited to them: it also includes students who left a California school as far back as 2006 without a confirmed transfer. More than 5.7 million students were enrolled in the 2025–26 school year alone, per CDE as reported by Reuters. The total number of people affected: Undisclosed.
What was taken. It varies by student, but it can include name, date of birth, home address, school, district and grade, the Statewide Student Identifier and local ID, gender, race or ethnicity, primary language and country of origin, disability and Section 504 status, testing accommodations, eligibility for Title I, McKinney-Vento and Military Connected programs, and assessment registration and results. CDE says there were no Social Security numbers, driver’s license or passport numbers, financial or card data, or passwords, and no parent or guardian information. ETS says it hasn’t seen the data published.
What’s been done. ETS disabled the account, took the SFTP site offline and built a new one with tighter controls. The SFTP site carried the statewide assessment data ETS exchanges with CDE for CAASPP and ELPAC. The California Cybersecurity Integration Center (Cal-CSIC) is doing the forensics, and CDE and the State Board of Education are reviewing whether ETS met its data security and contract requirements. Per Reuters, a CDE letter on Oct 2 told districts ETS had stopped normal enrollment data processing. Affected students get 24 months of Experian IdentityWorks, with enrollment open until Mar 19, 2027. Who did it and how the login was stolen: Undisclosed.
Why a security team should care. This wasn’t an exploit. One working login on a partner file-transfer site was enough to keep pulling files for four months, and the activity was found a week after it stopped. Most enterprises run the same setup: SFTP or managed-file-transfer accounts shared with vendors, customers or regulators, often password-only, rarely watched for volume. It’s also a vendor-risk story. The agency owns the data and the notice, but the contractor ran the system.
What we’d check. List every external-facing SFTP and MFT account and who owns it. Move partner accounts to keys or MFA with IP allowlists, and expire the ones nobody has used in 90 days. Baseline how much each account normally downloads and alert on spikes, new source IPs and odd hours. Then look at retention: if a partner exchange holds records years past the job it’s for, shrink what sits there.