ETS California Student Data Breach: Compromised Login Exposes Millions of Records

Nearly Four Months of Undetected Access on a File-Transfer Site

California families are receiving breach notifications after an intrusion at Educational Testing Service (ETS), which ran assessments for the California Department of Education, according to The Record. Rather than exploiting a complex software flaw, GovTech reports that an unauthorized party used a compromised login credential to access ETS systems.

That single credential allowed intruders to operate quietly for nearly four months. According to The Record, hackers copied data through a secure file transfer protocol site from May 22 to September 18, 2026. ETS discovered the breach on September 25, then disabled the affected account and took the site offline. Following the discovery, the state began notifying families on October 16, with notices continuing through November.

Scale of the Exposure: From 2025-2026 Enrollments Back to 2006

The reach of the stolen files spans both current pupils and former students. Malwarebytes reports that over 5.7 million students were enrolled in California public schools in 2025-2026, and the state said the breach covers students from the previous three school years and more. Specifically, LAist notes that affected data reaches back to 2023 enrollments, and to 2006 for students who left California without confirming a transfer to another school.

According to Malwarebytes, exposed data may include names, SSIDs, dates of birth, home addresses, demographic information, disability and program participation information and test scores. At the same time, Malwarebytes notes that Social Security numbers, financial account information, passwords and parent or guardian information were not involved.

In response to the incident, LAist reports that ETS is offering two years of free identity protection services, with an application deadline of March 19, 2027.

What This Means for Education Platforms and Assessment Vendors

While the ETS incident involves California public schools and has no direct operational link to Algeria, the architecture behind it—exchanging bulk student and examination files with external testing contractors—is common to education ministries, universities and examination boards worldwide. Three practical lessons stand out for education technology administrators in Algeria.

1. Replace single-credential file-transfer logins with multi-factor and network-restricted access

An unauthorized party was able to copy data through a secure file transfer protocol site from May 22 to September 18, 2026 using a compromised login credential, before ETS discovered the breach on September 25 and disabled the affected account. Any file-transfer server handling student registers or examination files should require multi-factor authentication, strict network allow-listing and short-lived session credentials.

2. Purge historical student records from active file-transfer staging folders

Because historical files remained accessible, the breach reached back not only to 2023 enrollments but all the way to 2006 for students who left California without confirming a transfer. File-transfer directories are meant for transit, not archival storage; once an assessment cycle closes, files containing names, dates of birth, home addresses and test scores should be deleted from transfer servers immediately.

3. Monitor outbound file-transfer volumes to catch intrusions before four months pass

The intruder copied data between May 22 and September 18 before the breach was discovered on September 25. Automated alerts on unusual download volumes or off-hours file transfers can flag a compromised vendor credential on day one rather than four months later.

The Structural Lesson

The California and ETS breach demonstrates that file-transfer servers are often the weakest link in public-sector data governance. Even when core databases exclude financial account information, passwords and parent or guardian details, staging folders on a secure file transfer protocol site can accumulate years of sensitive student records—including disability and program participation information—that remain exposed if a single login credential is compromised.

For educational institutions and public agencies in Algeria, the lesson is twofold: lock down file-transfer endpoints with the same rigour as primary databases, and never leave historical cohorts sitting on a transfer server once an examination cycle is complete.

Frequently Asked Questions

Sources & Further Reading

• California warns all public school students of data breach — The Record
• Testing company data breach affects millions of California students — GovTech
• California student data breach 2026: What to do — LAist
• Millions of California students affected by ETS data breach — Malwarebytes