Compromised ETS Login Used to Copy California Student Records
Summary
California says an intruder used a compromised ETS login to copy student records from an SFTP site between May and September 2026. The number affected is unknown; ETS shut down the account and site.
Key points
- CDE says an unauthorized party used a compromised login to access ETS’s SFTP site and copy student information between May 22 and September 18, 2026.
- The number of affected students has not been disclosed; the population may include current and former students dating back to 2006.
- Copied records may include names, birth dates, addresses, school details, IDs, demographic information, disability status, accommodations, and assessment data.
- The files reportedly did not include Social Security numbers, passwords, financial details, or parent and guardian information.
- ETS disabled the account and took the SFTP site offline; it is building a replacement with stronger safeguards.
- ETS has not explained how the login was compromised or identified the attacker. It says monitoring has found no evidence that the data was published.
- Student notifications began October 16, and affected current and former students can sign up for two years of free identity protection services.
Article Details
- Victim Organization
- Educational Testing Service (ETS)
- Incident Type
- Unauthorized access to an SFTP site using a compromised login credential, followed by copying student records.
- Incident Date
- 2026-05-22
- Disclosure Date
- 2026-10-02
- Data Types Exposed
- Student names
- Dates of birth
- Home addresses
- Schools, districts, and grades
- State and local ID numbers
- Gender
- Race or ethnicity
- Primary language
- Country of origin
- English learner status
- Disability and Section 504 status
- Primary disability type
- Testing accommodations
- English proficiency data
- Test registration and results
- Title I, McKinney-Vento, or military-connected student designations
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- ETS took the SFTP site offline and stopped regular enrollment-data processing while evaluating system security; some testing work was suspended. ETS began building a replacement site with stronger safeguards.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed