Hackers accessed and copied personal information belonging to millions of current and former California public school students through a compromised account at Educational Testing Service (ETS), according to an October 16 California Department of Education notification.
The intrusion occurred between May 22 and September 18, 2026, and was discovered September 25. The stolen records include information on students enrolled during the previous three school years, potentially affecting approximately 7 million individuals. Exposed data may include names, birth dates, addresses, student identification numbers, disability status, demographic information and assessment records
ETS said Social Security numbers, financial information and passwords were not compromised, and it has found no evidence that the stolen information has been made public. The organization disabled the compromised account, replaced the affected file-transfer system and is offering two years of identity-protection services.
ㅤYou can get up to speed here: https://cybernews.com/news/california-student-data-breach-millions-records-ets-hack/
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:
“One of the more troubling aspects of this incident isn’t simply the reported number of affected students. It’s what a single compromised account may have been able to access. In offensive security, we spend a great deal of time testing whether an attacker can get into a system. But the more important question is often what happens after they get in. Does that account have access to millions of records? Can someone extract that information without triggering an effective response? And are the security controls limiting the damage, or are we simply trusting that they will?
“The reported timeline also deserves attention. An intrusion spanning nearly four months raises legitimate questions about access monitoring, data-transfer controls, and how quickly suspicious activity can be identified. It doesn’t establish that every control failed, but it certainly gives investigators some important questions to answer. There’s also a tendency to take comfort when Social Security numbers and passwords aren’t involved. That’s good news, but names, birth dates, addresses, disability information, and educational records can still create meaningful privacy risks, particularly when the individuals affected are children. The lesson here isn’t that every third-party provider is insecure. It’s that trusting a provider and validating the security of that trust are two very different things.
“Organizations need to test what compromised identities can reach, what information can leave the environment, and whether their controls can detect and contain that activity. After all, an attacker doesn’t need administrative privileges if an ordinary account already has access to everything they came for.”
ㅤ
John Carberry, Solution Sleuth, Xcape Inc.:
“The compromise of seven million student records through Educational Testing Service (ETS) demonstrates the severe business and liability risks inherent in unmonitored vendor file transfers. While ETS confirmed that passwords, financial accounts, and Social Security numbers were not accessed, the exfiltrated records expose sensitive demographic markers, disability statuses, indicators identifying non-native English speakers, and details detailing how foreign students reside in California for their studies.
“Because the threat actor remains unidentified, asserting political motivation is unfounded speculation, yet the weaponization of permanent identity and demographic markers for targeted social engineering represents an enduring hazard across the Internet. For enterprise security teams, a four-month dwell time on an external secure file transfer protocol (SFTP) account reinforces the imperative for phishing-resistant multi-factor authentication, rigid data-retention schedules, and automated egress alerts. For impacted students and families, the practical defense requires taking advantage of the offered identity monitoring, inspecting credit files, and treating any unsolicited email soliciting further personal details with deep skepticism.
“Critical Takeaways:
- Extended vendor dwell time reveals severe identity governance gaps: Threat actors accessed the ETS SFTP platform undetected from May to September 2026, demonstrating the hazard of perimeter file servers that lack active session auditing and automated egress anomaly detection.
- Granular demographic records elevate social engineering risks: The exposed data includes disability status, non-native English speaker indicators, and foreign student residency information, giving adversaries rich contextual material for targeted spear-phishing campaigns without needing Social Security numbers.
- Student defense must balance credit monitoring with inbound skepticism: Victims should activate the complimentary identity protection and place fraud alerts, but their primary day-to-day defense is rigorous scrutiny of unsolicited emails requesting supplemental credentials or personal records.
“Four months of undetected exfiltration suggests the vendor file-transfer server was monitored by optimism rather than telemetry.”
ㅤ
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“Four months. That is how long one compromised login on Educational Testing Service’s file-transfer server went unnoticed while an attacker copied records on roughly seven million current and former California public school students. ETS runs the state’s mandated assessments for the California Department of Education, and that exchange ran through a secure file transfer protocol (SFTP) server gated by a single credential, one shared, poorly logged login that could read three school years of records.
“The reassurance that Social Security numbers were not taken misses what was taken. Disability status, testing accommodations, McKinney-Vento eligibility, which flags homeless students, and English learner status are more intimate than any credit file, and a child’s birth date and address never expire. The identity-protection services ETS is offering barely touch this risk, since misuse of this data will not run through a credit bureau.
“Two years of generic identity-protection services is not a deterrent. ETS gets seven million students’ records from the state and pays almost nothing when one compromised credential lets an attacker copy all of them. Breaches of data this sensitive need penalties big enough that robust safeguards become the cheaper option, and the current fallout is nowhere near that threshold. Until contractors face real financial consequences for failing to protect minors’ records, the SFTP servers stay configured the way they are. That is the price list that produced this breach, and without stronger penalties it will produce the next one.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“This concerns me because this information could be used against these students for years. There are far too many people willing to hold what someone did in high school against them when they’re applying for a job, going into politics, or seeking a political appointment. Very personal information could follow these kids into adulthood.
“The hard thing about incidents like this is that the damage isn’t immediately visible. It’s not ransomware shutting an organization down. It’s not stolen credit card information showing up as fraudulent transactions. The consequences may not become apparent for years.
“Honestly, I’d be terrified if someone shared my grades and information about what I was like in high school. I wasn’t exactly a genius. I made stupid decisions, and I would hate to have those decisions held against me for the rest of my life.
“That’s what makes this so concerning. It involves kids, and it could affect them for the rest of their lives based on a snapshot of who they were while they were still trying to grow up.”
The fact that the threat actors were in there for months is bad. And the result will be bad as well for those affected by this hack.
Hackers steal personal data of millions of California students
Posted in Commentary with tags Hacked on October 19, 2026 by itnerdHackers accessed and copied personal information belonging to millions of current and former California public school students through a compromised account at Educational Testing Service (ETS), according to an October 16 California Department of Education notification.
The intrusion occurred between May 22 and September 18, 2026, and was discovered September 25. The stolen records include information on students enrolled during the previous three school years, potentially affecting approximately 7 million individuals. Exposed data may include names, birth dates, addresses, student identification numbers, disability status, demographic information and assessment records
ETS said Social Security numbers, financial information and passwords were not compromised, and it has found no evidence that the stolen information has been made public. The organization disabled the compromised account, replaced the affected file-transfer system and is offering two years of identity-protection services.
ㅤYou can get up to speed here: https://cybernews.com/news/california-student-data-breach-millions-records-ets-hack/
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:
“One of the more troubling aspects of this incident isn’t simply the reported number of affected students. It’s what a single compromised account may have been able to access. In offensive security, we spend a great deal of time testing whether an attacker can get into a system. But the more important question is often what happens after they get in. Does that account have access to millions of records? Can someone extract that information without triggering an effective response? And are the security controls limiting the damage, or are we simply trusting that they will?
“The reported timeline also deserves attention. An intrusion spanning nearly four months raises legitimate questions about access monitoring, data-transfer controls, and how quickly suspicious activity can be identified. It doesn’t establish that every control failed, but it certainly gives investigators some important questions to answer. There’s also a tendency to take comfort when Social Security numbers and passwords aren’t involved. That’s good news, but names, birth dates, addresses, disability information, and educational records can still create meaningful privacy risks, particularly when the individuals affected are children. The lesson here isn’t that every third-party provider is insecure. It’s that trusting a provider and validating the security of that trust are two very different things.
“Organizations need to test what compromised identities can reach, what information can leave the environment, and whether their controls can detect and contain that activity. After all, an attacker doesn’t need administrative privileges if an ordinary account already has access to everything they came for.”
ㅤ
John Carberry, Solution Sleuth, Xcape Inc.:
“The compromise of seven million student records through Educational Testing Service (ETS) demonstrates the severe business and liability risks inherent in unmonitored vendor file transfers. While ETS confirmed that passwords, financial accounts, and Social Security numbers were not accessed, the exfiltrated records expose sensitive demographic markers, disability statuses, indicators identifying non-native English speakers, and details detailing how foreign students reside in California for their studies.
“Because the threat actor remains unidentified, asserting political motivation is unfounded speculation, yet the weaponization of permanent identity and demographic markers for targeted social engineering represents an enduring hazard across the Internet. For enterprise security teams, a four-month dwell time on an external secure file transfer protocol (SFTP) account reinforces the imperative for phishing-resistant multi-factor authentication, rigid data-retention schedules, and automated egress alerts. For impacted students and families, the practical defense requires taking advantage of the offered identity monitoring, inspecting credit files, and treating any unsolicited email soliciting further personal details with deep skepticism.
“Critical Takeaways:
“Four months of undetected exfiltration suggests the vendor file-transfer server was monitored by optimism rather than telemetry.”
ㅤ
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“Four months. That is how long one compromised login on Educational Testing Service’s file-transfer server went unnoticed while an attacker copied records on roughly seven million current and former California public school students. ETS runs the state’s mandated assessments for the California Department of Education, and that exchange ran through a secure file transfer protocol (SFTP) server gated by a single credential, one shared, poorly logged login that could read three school years of records.
“The reassurance that Social Security numbers were not taken misses what was taken. Disability status, testing accommodations, McKinney-Vento eligibility, which flags homeless students, and English learner status are more intimate than any credit file, and a child’s birth date and address never expire. The identity-protection services ETS is offering barely touch this risk, since misuse of this data will not run through a credit bureau.
“Two years of generic identity-protection services is not a deterrent. ETS gets seven million students’ records from the state and pays almost nothing when one compromised credential lets an attacker copy all of them. Breaches of data this sensitive need penalties big enough that robust safeguards become the cheaper option, and the current fallout is nowhere near that threshold. Until contractors face real financial consequences for failing to protect minors’ records, the SFTP servers stay configured the way they are. That is the price list that produced this breach, and without stronger penalties it will produce the next one.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“This concerns me because this information could be used against these students for years. There are far too many people willing to hold what someone did in high school against them when they’re applying for a job, going into politics, or seeking a political appointment. Very personal information could follow these kids into adulthood.
“The hard thing about incidents like this is that the damage isn’t immediately visible. It’s not ransomware shutting an organization down. It’s not stolen credit card information showing up as fraudulent transactions. The consequences may not become apparent for years.
“Honestly, I’d be terrified if someone shared my grades and information about what I was like in high school. I wasn’t exactly a genius. I made stupid decisions, and I would hate to have those decisions held against me for the rest of my life.
“That’s what makes this so concerning. It involves kids, and it could affect them for the rest of their lives based on a snapshot of who they were while they were still trying to grow up.”
The fact that the threat actors were in there for months is bad. And the result will be bad as well for those affected by this hack.
Leave a comment »