Summary
- Environment: ETS SFTP site exchanging California assessment data
- Operational impact: Student files copied; affected transfer site taken offline
- Financial impact: No financial loss quantified in the reviewed evidence
- Record status: Developing record. Reviewed October 17, 2026; updated as evidence emerges.
What happened
Educational Testing Service (ETS) reported that an unauthorized party used a compromised login to copy student files from its secure file-transfer (SFTP) site. The site exchanged statewide assessment information with the California Department of Education (CDE). [1]
Impact
Copied files covered California students, including all students enrolled during the three preceding school years and potentially others. The notice does not give a numerical total. [1]
Information varied by student and could include identity and contact details, student identifiers, school and grade, demographic and language information, disability and accommodation details, program eligibility, and assessment results. [1]
ETS said Social Security, driver’s license and passport numbers, financial/card information, passwords and parent or guardian information were excluded. [1]
Timeline
Credential misuse began
Start of the reported access interval.
[1]Reported access ended
Last date in the reported interval.
[1]Unauthorized activity detected
ETS identified the activity.
[1]Notice filed
The California registry recorded the CDE notice.
[2]Briefing updated
This briefing was last reviewed and updated on October 17, 2026.
Threat Group & Attack Vector
The credential-acquisition method, account subtype and any exploited vulnerability remain unknown.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1078 — Valid Accounts: use of a compromised login to access and copy files. [1]
Response
ETS disabled the account, took the site offline, investigated and began building a replacement with stronger controls. It offered two years of identity protection. CDE and state partners were reviewing the incident and contractual compliance. [1]
The notice says monitoring had found no public release of the data at that time. [1]