Millions of California students affected

Malwarebytes reports that millions of current and former California public school students had sensitive personal information stolen following a massive data breach at Educational Testing Service.

ETS breach exposed student files

The breach occurred in a Secure File Transfer Protocol system used by Educational Testing Service, a third party contractor for the California Department of Education managing student information.

Scale of the breach

The state's public schools counted more than five point seven million students in the two thousand twenty-five to two thousand twenty-six year alone.

Timeline of the attack

Attackers accessed and copied student files multiple times between May twenty-second and September eighteenth. The activity was discovered on September twenty-fifth. Files contained names, addresses, dates of birth and more.

Attackers used stolen passwords

Rather than exploiting a software vulnerability, attackers are believed to have gained access via compromised credentials. The specific attack vector details have not been shared by Educational Testing Service or the California Department of Education.

Response and protections offered

Educational Testing Service and the California Department of Education are notifying impacted individuals and providing twenty-four months of free identity protection software.No evidence shows stolen information was publicly released or that a ransom was demanded.

“We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices.”