One reusable login to a partner file-transfer service opened California's statewide testing data path for almost four months. According to SecurityWeek, citing California Department of Education notices, an unauthorized party used a compromised login credential on an Educational Testing Service (ETS) SFTP site that exchanges CAASPP and ELPAC assessment data with the state, and copied California student information at various times from May 22 through September 18, 2026. ETS spotted the activity on September 25, disabled the account, and took the site offline. How that credential was first obtained, and whether the SFTP account required any second factor, has not been publicly explained.
How the ETS SFTP login stayed open for months
According to the CDE breach notice quoted by SecurityWeek, the investigation determined that an unauthorized party used a compromised login credential at various times from May 22, 2026 to September 18, 2026 to access the SFTP site and copy files containing California student information. That is not a one-night smash-and-grab. It is repeated authenticated access across a summer and into the fall on a channel built for bulk exchange between ETS and the California Department of Education.
ETS provides CAASPP and ELPAC assessment work for California through its CDE contract. The SFTP site was the operational pipe for moving those files. Once the credential worked, the attacker did not need a second break-in story for each copy job. Sign in, pull files, leave, come back. Official notices do not describe malware on endpoints, a helpdesk reset drama, or a proxied web login. They describe a login credential that was already good enough for the transfer account.
ETS identified the unauthorized activity on September 25, 2026, disabled the compromised account, and took the SFTP site offline. CDE notified county and district superintendents and charter administrators on October 2. Student and family notifications began October 16, 2026, and were expected to continue into early November. During the response, ETS suspended some enrollment processing and testing work while it evaluated security, and later stood up a replacement SFTP site with enhanced controls.
The dwell window matters as much as the entry method. From first unauthorized access to discovery was more than four months. Partner transfer accounts often sit outside the same monitoring intensity as interactive employee SSO. When the only gate is a secret that still works, quiet bulk copy looks like ordinary file exchange until someone finally correlates volume, destination, or account behavior.
What California student files left the transfer site
According to CDE's notice as reported by SecurityWeek, information about California students, including but not limited to all students enrolled in the three previous school years, was accessed and copied. Some former-student records could reach back as far as 2006. Public-school enrollment in California was above 5.7 million students for the 2025-2026 year; that figure is enrollment scale, not a confirmed unique-victim headcount, and the exact number of distinct individuals in the copied sets has not been published.
The copied material included student names, Statewide Student Identifiers (SSIDs), dates of birth, addresses, demographic fields, disability and program participation data, and assessment results. According to the same reporting, the accessed files did not contain Social Security numbers, passwords, or financial or payment-card details. No student-account passwords sat in those assessment exports. That narrows some fraud paths and does nothing to erase the sensitivity of longitudinal education records tied to real children and families.
CDE and ETS stated that after working with law enforcement and cybersecurity experts, ETS took steps to reduce the potential risk of the data being made publicly accessible. No evidence has been reported that the copied files were posted for sale or dump. The full disposition of every copy the unauthorized party may still hold is not detailed in public notices. Affected individuals were offered two years of free identity protection.
Adjacent education-sector incidents appeared in the same SecurityWeek coverage only as related reading, not as proven links to this campaign: a deal around data stolen from the Canvas educational platform, and Mount Royal University's confirmation of data theft in a ransomware attack. Those are sector neighbors, not established co-conspirators of the ETS SFTP intrusion.
| Control surface | What sources show here | What still failed |
|---|---|---|
| SFTP login secret | Compromised credential worked repeatedly | Replayable factor opened bulk transfer |
| MFA on the account | Not disclosed in official notices | Unknown whether any second factor existed |
| Detection of copy volume | Found Sept 25 after May-Sept access | Months of authenticated pulls went unseen |
| Data minimization | No SSN/password/card in files | Names, SSID, DOB, programs, scores still left |
Why a single partner credential was enough
Workforce and partner file-transfer identities are still identities. An SFTP account that moves statewide assessment extracts is not a toy folder share. It is a privileged pipe into millions of student records. When access hangs on a login credential alone, theft of that secret becomes theft of the pipeline. Public reporting does not establish password spray, stuffing, phishing, vendor compromise, or insider misuse as the acquisition path. It only establishes that whatever process produced the secret left a credential an unauthorized party could present successfully.
Stronger authentication at the SFTP gate would have raised the bar before a session was issued, if the account used a password or other replayable factor and lacked stronger controls. After a successful login, copying files is ordinary authorized use of the channel. No login control un-copies bytes already pulled across four months of access. Least-privilege shares, egress monitoring, anomaly detection on partner accounts, and faster disablement are the containment layer once a session exists. The missing public detail is whether this particular account ever demanded anything beyond the compromised secret.
Education assessment vendors and state agencies share a structural problem: high-value bulk data, long retention for accountability systems, and operational accounts that must work for automated or scheduled transfer. Those accounts rarely get the same ceremony as an employee interactive cloud login, yet they often hold denser PII per connection. A four-month copy window on CAASPP/ELPAC exchange data is what that gap looks like when the secret still works and nobody is watching the meter.
If you want to skip the attack details and go straight to what can stop this class of partner file-transfer login failure, read the related article on mfa2point0.com: hardening partner SFTP and file-transfer accounts after the ETS California breach.
FAQ
How did attackers access the ETS California student files?
Attackers accessed the ETS California student files by authenticating to an ETS-operated SFTP site with a compromised login credential and copying assessment-related files at various times from May 22 to September 18, 2026. According to CDE notices reported by SecurityWeek, that credential was enough for repeated access to the CAASPP/ELPAC data-exchange channel with the California Department of Education. Official disclosures do not say how the credential was obtained or whether MFA protected the account.
What student information was copied in the ETS SFTP breach?
In the ETS SFTP breach, copied files included California student names, SSIDs, dates of birth, addresses, demographics, disability and program participation data, and assessment results. According to SecurityWeek's report on CDE notices, the sets covered students enrolled in the prior three school years and, in some cases, former students with records back to 2006. The files reportedly did not include SSNs, passwords, or payment-card data, and no exact unique-individual count has been published beyond a statewide public-school enrollment figure of more than 5.7 million for 2025-2026.
When did ETS discover the unauthorized SFTP access?
ETS discovered the unauthorized SFTP access on September 25, 2026, after unauthorized activity that began May 22, 2026 and continued through September 18, 2026. ETS then disabled the compromised account and took the SFTP site offline. CDE notified local education leaders on October 2, and family notifications started October 16, 2026.
Was the stolen ETS California student data posted online?
Public reporting on the ETS California student data incident has not shown evidence that the copied files were published or sold. CDE and ETS said ETS worked with law enforcement and cybersecurity experts and took steps to reduce the risk of public accessibility. The complete fate of every copy the unauthorized party may retain has not been detailed in the notices summarized by SecurityWeek.
Did MFA fail in the ETS SFTP credential breach?
Whether MFA failed in the ETS SFTP credential breach is unknown from public sources, because official notices do not state whether the compromised SFTP account required MFA at all. What is established is that a compromised login credential alone was sufficient for repeated authenticated access and file copying. Until ETS or CDE publishes the account's authentication posture, claims that a specific second factor was bypassed remain unsupported.
