Educational Testing Service (ETS), the nonprofit contractor that supports California’s statewide testing programs, has begun notifying students and families after an unauthorized user copied files from an ETS secure file-transfer site. California’s Department of Education said the incident affected information held for students enrolled during the three previous school years; the records and fields involved vary by person. [1] [2]

According to the state’s notice, ETS identified unauthorized activity on Sept. 25. Its investigation found that a compromised login credential was used at various times from May 22 through Sept. 18 to access the site and copy files. The exposed information may include names, dates of birth, addresses, student identifiers, demographic and program-participation details, disability-related information and assessment records. [1] [2]

The state says the copied data did not include Social Security numbers, financial account information, passwords or parent and guardian information. ETS has taken the affected file-transfer site offline and built a replacement with additional security controls. CDE said notifications began Oct. 16 and are expected to continue into early November. [1] [2]

What is known—and what remains uncertain

California and ETS said they had not found evidence that the information had been made public as of the notice. That does not establish that no misuse occurred; it describes what the investigation had found at that point. Reuters reported that the incident involved data for millions of students, but the state’s public notice says the specific information varies by individual and does not give a single verified total of affected records. [1] [3]

ETS is offering affected current and former students two years of identity-protection services at no cost. The state has also posted a detailed notice and resources for families in multiple languages. [1] [2]

The incident illustrates the reach of a third-party system that supports public testing: a credential compromise at the contractor’s file-transfer site exposed a broad set of student records, including sensitive education and disability information. CDE says it is reviewing the incident and coordinating with state cybersecurity partners and the vendor. [1] [2]

Sources

Why It Matters

The exposed fields include disability-related information and assessment records, categories that can be more sensitive than a name or address because they describe a student’s needs and performance. The state’s decision to offer identity-protection services for two years reflects the duration of risk that follows a copied record, even when Social Security numbers and financial details were not involved. The gap between the May-to-September access window and the September discovery also shows how long a compromised credential can operate before it is noticed.