Families across California are receiving letters about assessment data that should never have left a vendor’s file server. Intruders who obtained one valid password reached an SFTP site operated by Educational Testing Service and copied records describing public school students past and present, the California Department of Education says.
ETS delivers the state’s CAASPP and ELPAC testing programs under contract, exchanging results with the department over that same SFTP system. The company detected something wrong on September 25. Forensics then traced the earliest use of the credential back to late May, with the CDE breach notice pinning activity to May 22 through September 18.
Scope is unusually broad. Officials have not published a headcount, but the notice covers everyone enrolled across the three preceding school years, and CDE figures show more than 5.7 million students in California public schools during 2025-2026. The set also stretches to students who left as far back as 2006 without a CDE-confirmed transfer.
Copied fields vary by entry. Catalogued ones include birth date and name, address, campus and district, grade, sex, race or ethnicity, home language, country of origin, English learner status, state and local identifiers. Deeper entries carry disability and Section 504 flags, testing accommodations, English proficiency measures, exam sign-ups and scores. Title I, McKinney-Vento and military-connected eligibility may appear as well.
Social Security numbers, passwords, financial accounts, payment cards and parent or guardian details were not part of the files, per the notice.
ETS killed the intruder’s login and pulled the SFTP service down, then began building a hardened replacement. Neither the department nor the vendor has explained how the credential was lost or named a culprit. ETS said it is working with law enforcement and security specialists, and that its monitoring has surfaced no sign of publication so far.
