Tools / News / One Stolen Login Let an Intruder Copy California Student Files From ETS's Transfer Server for Four Months
Press

One Stolen Login Let an Intruder Copy California Student Files From ETS's Transfer Server for Four Months

· VaultTools

Educational Testing Service, which runs California's statewide tests, says an unauthorized party used a compromised credential to copy student files from its SFTP site between May 22 and September 18, 2026. The files cover all students enrolled in the previous three school years, with disability, test, and address data. Notifications began October 16.

VaultTools · October 21, 2026

An empty classroom with rows of desks facing a chalkboard, standing in for the millions of California students whose records sat on a file transfer server. Photo on Unsplash

Table of Contents

What Happened

Personal information on current and former California public school students was copied from a file transfer system run by Educational Testing Service (ETS), according to the California Department of Education (CDE). ETS is the nonprofit that runs California’s state and federally mandated tests, including the CAASPP and ELPAC assessments, under contract with the state, SecurityWeek reported.

The CDE notice says the affected population includes “all students enrolled in the three previous school years.” No victim count has been published. For scale, SecurityWeek and Malwarebytes note that more than 5.7 million students were enrolled in California public schools in 2025-2026. According to CyberInsider, the CDE FAQ also covers former students who left a California school as far back as 2006 without a confirmed transfer.

What Was Exposed

According to SecurityWeek, the fields vary by record. Basic data includes:

  • Name, date of birth, and home address
  • School, district, grade, and state and local student ID numbers
  • Gender, race or ethnicity, primary language, country of origin, and English learner status

Some records also contain far more sensitive fields:

  • Disability and Section 504 status, primary disability type, and testing accommodations
  • English proficiency data, test registrations, and test results
  • Title I, McKinney-Vento (homeless student), and military-connected designations

Per the notice, Social Security numbers, passwords, financial account and payment card data, and parent or guardian information were not involved. ETS says its web monitoring has found no evidence that the data has been published.

How It Happened

The affected system was an SFTP site that ETS used to exchange statewide assessment data with the CDE, CyberInsider reported. The CDE notice says an unauthorized party “used a compromised login credential at various times” between May 22 and September 18, 2026, and copied student files.

Neither ETS nor the CDE has explained how the credential was compromised or who used it. ETS disabled the account, took the SFTP site offline, and is building a replacement with stronger safeguards, according to SecurityWeek. It also paused regular enrollment data processing and some testing work while its security was reviewed. CyberInsider reports that the CDE and the State Board of Education are reviewing ETS’s compliance with its security and contract requirements.

The Disclosure Timeline

  • May 22, 2026: Earliest unauthorized access to the SFTP site, per the CDE notice.
  • September 18, 2026: Last recorded access.
  • September 25, 2026: ETS detects the unauthorized activity.
  • October 2, 2026: The CDE writes to superintendents and charter school administrators.
  • October 16, 2026: Notifications to students and families begin, expected to run into early November.

Affected students can enroll in two years of free Experian IdentityWorks identity protection until March 19, 2027, according to CyberInsider.

Why This Matters for Browser-Based File Tools

A file transfer server is meant to be a pipe. In practice, files land on it and stay there, which is why a single working login gave an intruder repeated access for almost four months. The copies outlived the transfer that justified them.

Statewide testing data has to move between a contractor and a state agency, and no client-side tool changes that. What the incident does show is the cost of every extra copy: each file parked on a server is one more thing that a stolen password can reach.

For your own files, that cost is optional. VaultTools runs every tool in your browser, compiled to WebAssembly. Converting a spreadsheet, compressing a PDF, or zipping a folder happens on your device, so there is no upload, no staging folder on someone else’s server, and no account whose credentials could later expose it. Opening a roster or grade export in the CSV viewer works the same way: the rows never leave your machine.

Sources

← Back to all news