What happened
Educational Testing Service, the nonprofit that runs California's state and federally mandated testing under contract with the state, detected unauthorised activity on a secure file transfer site on September 25. The California Department of Education's breach notice states what the investigation then found: an unauthorised party used a compromised login credential at various times between May 22 and September 18, 2026, to access the SFTP site and copy files containing California student information.
The site existed for a routine purpose: ETS used it to exchange testing data with the department for the CAASPP and ELPAC assessment programmes. No victim count has been published. The notice says "all students enrolled in the three previous school years" were affected, and the department's FAQ adds students who left a California school as far back as 2006. More than 5.7 million students were enrolled in California public schools in 2025-26, so the exposed population is measured in millions.
What was in the files reads like a full student record: name, birth date, address, school, district and grade, state and local ID numbers, gender, race or ethnicity, primary language, country of origin and English learner status. Some entries also carried disability and Section 504 status, testing accommodations and test results, or showed whether a student qualified for Title I, McKinney-Vento or military-connected designations. The notice says the files held no Social Security numbers, passwords, financial or payment card details, and no parent or guardian information.
ETS disabled the account, took the SFTP site offline and is building a replacement with stronger safeguards. The public disclosures do not explain how the credential was compromised or name an attacker, and ETS says its web monitoring has found no evidence the data has been published. The department told county and district superintendents and charter administrators in a letter dated October 2, and student notifications began on October 16, continuing into early November with two years of identity protection offered.
Why this is a GRC story
The control that failed was not exotic. A file transfer endpoint with one credential and no behavioural baseline is one of the quietest places in an estate. Nobody watches the SFTP box until it appears in a headline. One login held records for every student in the largest school system in the country plus former students back two decades, so a single credential became a statewide incident.
The notification sequence will be examined. Internal notice to district leadership on October 2, public student notifications from October 16, detection on September 25 with access that began in May. Each gap has a defensible reason and each one is the kind of interval regulators and plaintiffs now measure.
What to watch
Watch whether a victim count is published and whether the retention question gets picked up, because keeping records on former students back to 2006 is a data minimisation decision that will be hard to explain. Watch what the ETS contract says about audit rights, logging and breach cooperation.
For anyone holding third party data flows, the audit question is direct. Which accounts can pull bulk extracts, who reviews that activity, and how long the logs last. If the answer depends on the vendor telling you, the control is a promise rather than a check.
Attribution: Analysis based on SecurityWeek and related public reporting. This article is original commentary, not a repost of the source material.