ETS Student Data Breach Prompts California to Review Contractor Security

The California Department of Education (CDE) disclosed on October 16, 2026, that a file-transfer system operated by Educational Testing Service (ETS) was accessed by an unauthorized party, exposing personal information associated with millions of current and former California public school students. The system supported the exchange of student assessment information between ETS and the state. The incident is relevant to government contractors and procurement teams because it illustrates the operational and oversight risks that arise when vendors handle sensitive data on behalf of public agencies, particularly information concerning children and education services.

According to the state notice described in the source reporting, the unauthorized party used compromised login credentials to access the ETS-operated secure file transfer protocol (SFTP) site and copy files on multiple occasions between May 22 and September 18, 2026. ETS detected suspicious activity on September 25. After identifying the incident, the organization disabled the affected account and took the compromised file-transfer site offline. ETS subsequently built a replacement system with enhanced security controls and began working with cybersecurity experts and law enforcement. California officials said they were coordinating with state cybersecurity agencies to assess the incident and inform affected students and families.

The potentially exposed records vary by individual and include names, dates of birth, residential addresses, school and district details, grade levels, student identification numbers, and statewide assessment records. Some files also contained demographic and language-related information, disability status, testing accommodations, and participation in certain educational support programs. The source reports that the breach did not involve Social Security numbers, driver’s license or passport numbers, financial account information, payment card details, account passwords, or parent and guardian personal information. This distinction is important for communicating the incident accurately, while the exposure of disability-related and other sensitive education records still creates significant privacy and safeguarding concerns.

For GovCon and state-and-local procurement professionals, the incident supports a closer review of how contracts define security responsibilities for vendors operating data-exchange platforms. Agencies can use the event to examine credential management, account permissions, monitoring and alerting, incident notification procedures, data minimization, and vendor access to legacy records. Contractors serving education clients should be ready to explain how they secure file-transfer systems, protect credentials, limit access, and investigate suspicious activity. Notifications to affected Californians are expected to continue through early November, but the available reporting identifies no procurement deadline, new solicitation, or contract opportunity. The reporting also names Experian in connection with the incident, without specifying further details in the supplied source excerpt.

• CDE disclosed the incident on October 16, 2026, involving an ETS-operated SFTP site used to exchange assessment information.
• Compromised credentials were reportedly used to access the system and copy files between May 22 and September 18, 2026; ETS detected suspicious activity on September 25.
• Records may include student names, birth dates, home addresses, school and district details, grade levels, student IDs, and assessment information.
• Some affected records contained demographic, language-related, disability, testing-accommodation, and educational-support-program information.
• The reported exposure did not include Social Security numbers, government-issued identification numbers, financial or payment-card data, passwords, or parent and guardian personal information.
• ETS disabled the affected account, took the compromised site offline, and created a replacement system with enhanced security controls.
• ETS is working with cybersecurity experts and law enforcement; California officials are coordinating with state cybersecurity agencies.
• Notifications to affected students and families are expected to continue through early November; no specific response deadline is stated.
• Education agencies should assess contractor controls for credentials, access permissions, file-transfer security, monitoring, and incident response.
• No new solicitation, contract award, or procurement action is identified in the available reporting.