Sensitive files containing the names, home addresses, and birth dates of millions of California public school students were accessed and copied without authorization from a Secure File Transfer Protocol system managed by the Educational Testing Service, Telset.id reported. The unauthorized access persisted undetected across a four-month period before system monitors flagged the activity.
The breach affects a massive segment of the state’s public education system. California Department of Education enrollment figures and Malwarebytes tracking indicate that the exposed records encompass students registered across multiple academic years, threatening roughly 17 million students with potential data exposure.
Unauthorized File Access Across Four Months
The security compromise inside the Educational Testing Service network began on May 22, according to Malwarebytes reporting cited by TechRadar. Attackers repeatedly accessed and copied sensitive student data files on the Secure File Transfer Protocol server until September 18. System administrators did not detect the unauthorized data extractions until September 25.
Investigators determined that the breach did not stem from a software vulnerability or system exploit. Instead, security analysts trace the unauthorized entry to compromised user credentials. The intrusion highlights how stolen login credentials can grant external actors prolonged access to sensitive institutional repositories without triggering immediate system alarms.
Estimated Impact on California Students
While the Educational Testing Service has not released an exact tally of affected individuals, the scope of the incident makes it one of the largest educational data breaches on record. California public schools enrolled more than 5.7 million students during the 2025–2026 academic year alone. The California Department of Education determined that students enrolled during the preceding three academic years also face exposure, pushing the total number of potentially impacted children to approximately 17 million students.
The compromised files contain specific personal identifiers, including full names, residential addresses, and birth dates. Security teams have found no evidence indicating that the stolen database has been published publicly, and perpetrators have not issued a ransom demand.
Mitigation Steps and Network Security Overhauls
In response to the breach, the Educational Testing Service and the California Department of Education started notifying affected individuals. State and corporate partners are providing impacted families with free identity protection software valid for 24 months.
Educational Testing Service representatives informed Reuters that the organization deployed additional administrative and technical safeguards following the incident. The remediation measures include heightened network monitoring, stricter access controls, and comprehensive third-party audits of existing security protocols.
What data was stolen and how long was access?
What specific data elements were accessed during the breach?
The unauthorized files contained students’ full names, home addresses, and birth dates. No financial records or social security numbers have been confirmed as part of the exposed files.
ETS data breach exposes California students’ personal information#ETS #DataBreach #California https://t.co/DMaXWmDZRa
How long were the attackers able to access the system undetected?
Attackers accessed and copied files between May 22 and September 18. System monitors did not identify the suspicious network activity until September 25.
What recourse do affected families have?
The Educational Testing Service and the California Department of Education are providing notification letters alongside complimentary identity protection software for a duration of 24 months.
More on Educational Testing Service
Related reading