California Reviews ETS Security Compliance After Student Data Breach

A September breach involving Educational Testing Service (ETS), California’s statewide assessment contractor, has put the security of education technology vendors under renewed scrutiny. According to the source report, an unauthorized party used a compromised login credential to access and copy student information over several months. Information exposed included student names, birth dates, addresses, assessment data and certain disability-related information. The incident affected millions of current and former California public school students and has raised questions about how education agencies oversee contractors entrusted with sensitive records.

The California Department of Education (CDE) is reviewing ETS’s compliance with applicable contractual and data-security requirements. The review’s findings have not been announced, and the available reporting does not identify a contract value, a new procurement deadline or a specific change to the statewide assessment contract. ETS also faces a proposed class-action lawsuit alleging inadequate safeguards, according to the source. For procurement and program officials, the immediate issue is whether contract language and oversight processes provide enforceable, verifiable protections—not simply whether a vendor represents that it follows security standards.

The reporting points to a broader accountability challenge for K-12 technology procurement. Laurel Nava, executive director of California IT in Education, said: “You can ask a vendor so many times: Are they following these security practices? Are they following security standards? But we have no way to check and verify those.” That concern has direct implications for solicitations, contract clauses, vendor assessments and ongoing monitoring. Agencies can consider specifying evidence requirements, review rights, access controls, incident reporting expectations and data-handling practices, then assigning staff and resources to validate compliance throughout performance.

Experts cited in the source also connect prevention to investment and workable implementation. TJ Sayers of the Center for Internet Security cautioned against treating large breaches as inevitable. Doug Levin of the K12 Security Information Exchange estimated that roughly 80 percent of cybersecurity incidents affecting schools and vendors could be prevented through basic security practices; he said the remaining incidents may involve sophisticated attacks, newly discovered vulnerabilities or other difficult-to-anticipate circumstances. Levin also noted that safeguards require funding and leadership support and can add steps for educators, including review processes for new apps and tools. The procurement takeaway is to align security requirements with dedicated funding, consistent vendor review and practical workflows, while minimizing the student data collected and limiting who can access it.

• CDE is reviewing ETS’s compliance with contractual and data-security requirements; the review’s findings have not yet been announced.
• The September incident involved a compromised login credential used by an unauthorized party to access and copy student information over several months.
• Reported exposed information included names, birth dates, addresses, assessment information and certain disability-related data belonging to millions of current and former California public school students.
• ETS is California’s statewide assessment contractor and faces a proposed class-action lawsuit alleging inadequate safeguards, according to the report.
• Procurement teams should assess whether contracts define verifiable security controls, data-handling expectations, access management, oversight rights and evidence of compliance.
• Education agencies and vendors should review data minimization and restrict access to systems containing student information.
• Doug Levin estimated that roughly 80 percent of cybersecurity incidents affecting schools and vendors could be prevented through basic security practices; this is an expert estimate, not a reported audit finding.
• Security improvements require funding and leadership support, and review processes should account for educators’ operational needs when evaluating apps and other tools.
• The source provides no contract value, new deadline or announced outcome from the CDE review; agencies should monitor for findings before assuming specific procurement changes.