--- title: "ETS California student-data incident" description: "A compromised ETS login allowed copying of California student assessment files from an SFTP site between May and September 2026." incident_type: "Data incident" status: "active" last_modified: "2026-10-17" canonical_url: "https://www.ally.security/incidents/ets-california-student-data-incident-2026" markdown_url: "https://www.ally.security/incidents/ets-california-student-data-incident-2026.md" stix_url: "https://www.ally.security/incidents/ets-california-student-data-incident-2026/stix.json" --- # ETS California student-data incident ETS disclosed copying of California student records from a file-transfer site used with CDE. Last modified Oct 17, 2026 · 2 sources ## Summary - **Environment:** ETS SFTP site exchanging California assessment data - **Operational impact:** Student files copied; affected transfer site taken offline - **Financial impact:** No financial loss quantified in the reviewed evidence ## What happened [Educational Testing Service (ETS)](https://www.ets.org/) reported that an unauthorized party used a compromised login to copy student files from its secure file-transfer (SFTP) site. The site exchanged statewide assessment information with the [California Department of Education (CDE)](https://www.cde.ca.gov/). [1](#source-1) ## Impact Copied files covered California students, including all students enrolled during the three preceding school years and potentially others. The notice does not give a numerical total. [1](#source-1) Information varied by student and could include identity and contact details, student identifiers, school and grade, demographic and language information, disability and accommodation details, program eligibility, and assessment results. [1](#source-1) ETS said Social Security, driver's license and passport numbers, financial/card information, passwords and parent or guardian information were excluded. [1](#source-1) ## Timeline ### May 22, 2026 — Credential misuse began Start of the reported access interval. [1](#source-1) ### September 18, 2026 — Reported access ended Last date in the reported interval. [1](#source-1) ### September 25, 2026 — Unauthorized activity detected ETS identified the activity. [1](#source-1) ### October 16, 2026 — Notice filed The [California registry](https://oag.ca.gov/privacy/databreach/list) recorded the CDE notice. [2](#source-2) ### October 17, 2026 — Briefing updated This briefing was last reviewed and updated on October 17, 2026. ## Threat Group & Attack Vector The credential-acquisition method, account subtype and any exploited vulnerability remain unknown. ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): use of a compromised login to access and copy files. [1](#source-1) ## Response ETS disabled the account, took the site offline, investigated and began building a replacement with stronger controls. It offered two years of identity protection. CDE and state partners were reviewing the incident and contractual compliance. [1](#source-1) The [notice](https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_3_Redacted.pdf) says monitoring had found no public release of the data at that time. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Educational Testing Service — Notice of Data Breach official · Educational Testing Service · Oct 16, 2026 ### Data Security Breach List — 2026 records regulatory · California Department of Justice, Office of the Attorney General
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** ETS California student-data breach: ETS offered affected current and former students two years of identity-protection services through Experian. 2. **Resulted In · 100% confidence · current** ETS California student-data breach: Copied California student assessment files 3. **Exposed Data Category · 100% confidence · current** Copied California student assessment files: Names 4. **Resulted In · 100% confidence · current** ETS California student-data breach: CDE and the State Board of Education were reviewing the incident and ETS’s compliance with security and contractual requirements, with support from state cybersecurity authorities. 5. **Processor For · 100% confidence · current** Educational Testing Service: California Department of Education 6. **Exposed Data Category · 100% confidence · current** Copied California student assessment files: Student identifiers 7. **Ended At · 100% confidence · current** ETS California student-data breach: 2026-09-18 8. **Resulted In · 100% confidence · current** ETS California student-data breach: ETS said the copied data excluded Social Security, driver’s license and passport numbers, financial and card information, passwords, and parent or guardian personal information. 9. **Resulted In · 100% confidence · current** Reported access interval ended: Last date in the reported credential-use interval. 10. **Resulted In · 100% confidence · current** ETS California student-data breach: An unauthorized party used a compromised login credential at various times from May 22 through September 18, 2026, to access an ETS SFTP site and copy California student files. 11. **Exposed Data Category · 100% confidence · current** Copied California student assessment files: Education records 12. **Resulted In · 100% confidence · current** Notice filed with California: The California registry recorded the CDE notice. 13. **Resulted In · 100% confidence · current** ETS California student-data breach: ETS disabled the account, took the SFTP site offline, and engaged external cybersecurity experts. 14. **Resulted In · 100% confidence · current** ETS California student-data breach: Fields vary by individual and may include student identity and address, school and district, grade, student identifiers, demographic and language information, disability and accommodation details, program eligibility, and assessment participation and results. 15. **Discovered At · 100% confidence · current** ETS California student-data breach: 2026-09-25 16. **Affected Organization · 100% confidence · current** ETS California student-data breach: Educational Testing Service 17. **Used Attack Technique · 100% confidence · current** ETS California student-data breach: https://attack.mitre.org/techniques/T1078/ 18. **Began At · 100% confidence · current** ETS California student-data breach: 2026-05-22 19. **Occurred At · 100% confidence · current** Notice filed with California: 2026-10-16 20. **Resulted In · 100% confidence · current** ETS California student-data breach: Reported access interval ended 21. **Resulted In · 100% confidence · current** Unauthorized access began: Start of the reported credential-use interval. 22. **Occurred At · 100% confidence · current** Unauthorized access began: 2026-05-22 23. **Disclosed At · 100% confidence · current** ETS California student-data breach: 2026-10-16 24. **Exposed Data Category · 100% confidence · current** Copied California student assessment files: Demographic information 25. **Resulted In · 100% confidence · current** ETS California student-data breach: Notice filed with California 26. **Resulted In · 100% confidence · current** ETS California student-data breach: The copied information covers California students, including but not limited to all students enrolled in the three previous school years. 27. **Exposed Data Category · 100% confidence · current** Copied California student assessment files: Contact information 28. **Affected Organization · 100% confidence · current** ETS California student-data breach: California Department of Education 29. **Resulted In · 100% confidence · current** ETS California student-data breach: Unauthorized access began 30. **Exposed Data Category · 100% confidence · current** Copied California student assessment files: Disability and special-education information 31. **Resulted In · 100% confidence · current** ETS California student-data breach: The affected SFTP site exchanged California statewide assessment information with CDE. 32. **Occurred At · 100% confidence · current** Reported access interval ended: 2026-09-18 33. **Resulted In · 100% confidence · current** ETS California student-data breach: ETS detected unauthorized activity 34. **Resulted In · 100% confidence · current** ETS California student-data breach: ETS said its monitoring had not found evidence that the information had been made public as of the notice. 35. **Occurred At · 100% confidence · current** ETS detected unauthorized activity: 2026-09-25 36. **Exposed Data Category · 100% confidence · current** Copied California student assessment files: Dates of birth 37. **Resulted In · 100% confidence · current** ETS California student-data breach: ETS said it was building a replacement SFTP site with enhanced security controls. 38. **Resulted In · 100% confidence · current** ETS detected unauthorized activity: ETS identified activity involving the student-information SFTP site.