- California Department of Education third-party partner falls victim to a data breach attack
- An estimated three years' worth of students (5.7 million per year) likely affected
- It seems access was obtained by a simple password theft
Malwarebytes has reported that millions of current and former California public school students have had their sensitive personal information stole following a massive data breach.
The breach occurred in a Secure File Transfer Protocol (SFTP) system used by Educational Testing Service (ETS) – a third party used by the California Department of Education for managing student information.
According to the report, the attackers were able to regain entry repeatedly over the course of four months, accessing student files filled with names, addresses, dates of birth and more.
California student system breach likely impacting millions
Though ETS hasn't officially disclosed how many students have been impacted, Malwarebytes notes that the state's public schools counted more than 5.7 million students in the 2025-2026 year alone. The state's Department of Education believes students who enrolled in the previous three years could be impacted – or around 17 million students if all three years were equal.
The sensitive files were accessed and copied multiple times between May 22 and September 18, with the activity finally being discovered on September 25, and it all comes down to human vulnerability.
Rather than a software vulnerability, the attackers are believed to have gained access via compromised credentials, though the intricacies around the specific attack vector haven't been shared yet.
ETS and the California Department of Education are both working to notify impacted individuals, who are being given 24 months of identity protection software for free. No evidence seems to have been found to prove that the stolen information has been publicly released, and it doesn't seem that a ransom threat has been made.
"We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices," ETS added in a statement (via Reuters).
