Personal records on millions of current and former California public school students were copied from a file transfer server run by Educational Testing Service (ETS), the nonprofit that runs the state's standardized tests under contract with the California Department of Education (CDE). According to Malwarebytes' report on the breach notice, the intruder got in with compromised login details and took files at various times between May 22 and September 18.
That is close to four months of access to a secure file transfer protocol (SFTP) site, a server used to move bulk files between organizations, before the activity ended.
Disability and test data, not just names
The CDE says the breach covers every student enrolled during the previous three school years, and that the affected group is not limited to them. For scale, more than 5.7 million students were enrolled in California public schools in the 2025 to 2026 school year alone. Not every student had every field exposed, but the data involved may include:
- Student names and Statewide Student Identifiers (SSIDs)
- Dates of birth and home addresses
- Demographic information
- Disability and program participation information
- Statewide assessment information, including test scores
The CDE says Social Security numbers, financial account information, passwords and parent or guardian information were not involved. ETS says it has found no evidence so far that the stolen information has been published.
That leaves a dataset that is of limited use for straightforward financial fraud but highly personal: a child's disability status and test history tied to a name, birth date and home address. For a minor, stolen identity details can also sit unnoticed for years before anyone checks a credit file. Schools and their suppliers have been a recurring target, from ransomware hitting Brazil's schools through stolen logins to crews steadily adding school districts to their leak sites. No group has claimed this intrusion.
Take the two years of free monitoring, and watch for tailored scams
ETS is notifying affected students and families at the CDE's direction and is offering two years of free identity protection services. Parents or legal guardians can enroll affected minors, and affected adults can enroll themselves, following the instructions for their age group in the notice.
Malwarebytes also advises families to:
- Verify any message about the incident through official CDE or ETS channels before acting on it.
- Treat with suspicion any email, text or call that uses details about a child or their school to sound convincing, since that is exactly the information that was taken.
- Never share passwords, security codes or payment details in response to an unsolicited contact.
The breach was not in a school's own systems but in a contractor's file server, accessed with a valid login. For the many districts and state agencies that hand student records to testing and analytics vendors, it is a reminder that the weakest account protecting that data may not be one they manage. More US coverage is on the United States country page.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.