What happens when a trusted service provider becomes your establishment’s weakest security link? A recent California student data breach highlights that danger, with hackers reportedly accessing millions of personal records through stolen login credentials. Learn more here.
Student Records Fall Into the Wrong Hands
A major cyberattack on educational nonprofits has exposed sensitive student information belonging to millions of present and past enrollees in California public schools. The victim was Educational Testing Service (ETS), a nonprofit organization that helps facilitate statewide assessments.
While officials haven’t confirmed the exact number of affected individuals, the incident involved those who enrolled during at least the previous three school years. California alone had over 5.7 million students in 2025 to 2026.
The stolen files contained extensive personally identifiable information (PII), including:
- Student names and home addresses
- Statewide Student Identifiers (SSIDs)
- Dates of birth and school enrollment details
- Race and ethnicity
- Disability status and educational accommodations
- Assessment results and program eligibility records
Fortunately, authorities noted that SSNs, account passwords, and financial information weren’t compromised.
How Did Hackers Get Past Security?
This California student data breach stemmed from attackers gaining unauthorized access to an ETS-operated Secure File Transfer Protocol (SFTP) server, which allows organizations to exchange files securely over a network.
In this particular case, the platform transferred student assessment information between the contractor and state education officials. Investigators discovered that someone had obtained valid login credentials and used them to copy confidential files repeatedly from May 22 to September 18 this year.
ETS finally detected the suspicious activity on September 25, but how the intruders originally obtained the credentials remains unclear.
How Authorities Responded
After discovering the intrusion, ETS revoked access to the compromised account and shut down the file-transfer system. They also began developing a replacement system with stronger security controls. Meanwhile, California’s Department of Education coordinated with cybersecurity specialists to investigate the incident and assess its impact.
Affected individuals are receiving regular notifications, and ETS is providing two years’ worth of Experian IdentityWorks identity-protection services for free.
Officials emphasized that investigators haven’t found evidence of the stolen information becoming publicly available. While this provides some reassurance, it doesn’t eliminate the possibility of future misuse.
How Secure Are the Companies You Trust?
Strong cybersecurity isn’t just about protecting your own systems but also knowing whether your partners take security as seriously as you do. Even legitimate contractors introduce additional data security and privacy risks.
Consider the following precautions:
- Evaluate vendors’ safeguards: Don’t just take their word for it. Ask about security certifications and how they handle confidential records.
- Tighten your access controls: Require multifactor authentication and restrict permissions based on what each employee actually needs.
- Watch for warning signs: Excessive download volumes or unexpected login activity may signal an ongoing intrusion.
- Set clear reporting expectations: Require service providers to notify you promptly about suspicious activity and explain their response plans.
If your company regularly shares business data with third-party organizations, let the California student data breach serve as an important lesson. Take the proactive route and address potential weaknesses in relationships before they compromise your sensitive information.
