9 min read
On 16 October 2026, the California Department of Education confirmed what many parents had no idea was even possible: a contractor they had never heard of had been quietly copying their children's school records for roughly four months. The contractor was Educational Testing Service (ETS), a nonprofit that administers California's standardised assessment programmes. The intruder walked in using compromised login credentials, helped themselves to files on an SFTP site, and left without triggering any alarm until mid-September.
The breach is significant not because of dramatic financial theft—Social Security numbers and bank details were not among the exposed fields—but because of the sheer depth of the personal profiles involved, the age range of the records, and the near-total invisibility of the vendor relationship to most families. This article breaks down exactly what happened, what data was taken, and why incidents like this are structurally likely to keep happening.
What Happened and When
According to the disclosure, an unauthorised party used compromised credentials to access an SFTP (Secure File Transfer Protocol) site operated by ETS. Access began on 22 May 2026 and continued undetected until 18 September 2026—a window of approximately four months. During that period, the attacker was able to copy student files.
ETS took the SFTP site offline after discovering the intrusion and rebuilt it with enhanced security controls. Notifications to affected families began on 16 October and were expected to run through early November 2026.
Four months is a long time. It is long enough to copy, organise, and act on data in multiple ways before anyone knows it is gone. The delayed detection is not unusual in credential-based intrusions—because the attacker is presenting valid login details, automated systems often see nothing anomalous until a human or a more sophisticated behavioural monitor notices something wrong.
What Data Was Exposed
The stolen fields paint a detailed picture of each affected child. According to the disclosure, the compromised records included:
- Full name and date of birth
- Home address
- Grade level, school, and district
- Statewide student ID number
- Gender, race or ethnicity
- Primary language and country of origin
- English learner status
- Disability status and Section 504 status
- Programme eligibility information
- Standardised test scores
Social Security numbers, driver's licence numbers, and financial information were not included. That distinction matters, but it should not be overstated. A record combining a child's full name, home address, date of birth, disability status, primary language, and school is not a minor data point—it is a detailed profile. For children with disabilities or from immigrant families, the sensitivity of some of these fields is particularly acute.
How Many Students Are Affected
More than 5.7 million students were enrolled in California public schools during the 2025–26 school year. The breach also covers students enrolled since 2023, and because ETS retained records going back to 2006, former students who left California without formally confirming a transfer to another state may also be affected. The practical scope of exposure could therefore extend well beyond the current student population.
There is no public figure yet confirming the exact number of records copied—only the disclosure that the attacker had access to the files for four months. Families who received a notification letter are affected; families who have not yet received one but have had children in California public schools since 2006 may still be within the affected dataset and should watch for communications through early November.
Why Third-Party Vendors Are a Persistent Weak Point
Most parents are familiar with the concept of their child's school holding records. Far fewer realise how many contractors handle that data downstream. Testing providers, student information system vendors, special education platform operators, and assessment analytics firms all routinely receive copies of student records to perform the services schools and districts contract them for. Each one is a potential entry point.
The ETS breach illustrates a few structural problems that make this category of vendor particularly exposed:
Credential-based access is easy to abuse silently
SFTP is a legitimate, widely used file transfer protocol. Accessing it with valid credentials generates log entries that look, superficially, like normal activity. Unless the receiving organisation monitors for anomalous access patterns—unusual hours, unusual volumes, access from unexpected IP addresses—a credential compromise can persist for a very long time. Four months is a textbook example of that failure mode.
Parents have no direct relationship with the vendor
When a school district contracts with a testing provider, parents generally have no visibility into that arrangement and no practical ability to opt out. The data flows because the law requires children to sit certain assessments, and the contractor holds whatever the assessment programme requires. There is no meaningful consent mechanism on the receiving end.
Records accumulate over decades
The fact that records going back to 2006 may be in scope is a direct consequence of data retention practices in education. Assessment records are kept for longitudinal research and accountability purposes. That is a legitimate use, but it means the blast radius of any single breach grows with every passing year.
What the Exposed Data Could Be Used For
Without Social Security numbers or financial details, the immediate identity-theft risk is lower than in some breaches. The longer-term concerns are different in character but still real.
Targeted phishing and social engineering. A record that includes a child's name, address, school, grade, and primary language gives an attacker enough context to craft convincing messages to parents—impersonating a school administrator, a district official, or a testing body. Because the detail in the message matches reality, the recipient is more likely to trust it.
Profiling of vulnerable children. Disability status, Section 504 status, and English learner status are sensitive categories. Records that flag a child as having a disability or as coming from a non-English-speaking household could be used to target families who may be less likely to recognise or report suspicious contact.
Long-term identity risk for minors. Children have clean credit histories and, crucially, their records are rarely monitored. Data assembled now about a ten-year-old can sit dormant until that child reaches adulthood and becomes a more valuable financial target.
What Affected Families Can Do Now
ETS and the California Department of Education are responsible for remediation at the institutional level. At the family level, there are concrete steps worth taking:
- Look for a notification letter. Outreach to affected families began 16 October and continues through early November 2026. If you have or had a child in California public schools and have not received a letter, monitor your post carefully over that period.
- Consider placing a credit freeze for your child. All three major US credit bureaus allow parents to place a freeze on a minor's credit file. Because young children typically have no credit history, fraudulent accounts opened in their name may not be discovered for years. A freeze prevents new accounts from being opened.
- Be sceptical of communications that reference your child's school details. If you receive a message—email, text, or letter—that includes specific school, grade, or programme information about your child, treat it with extra scrutiny before clicking any link or providing information.
- Watch for unusual activity. Even without financial data in the breach, keep an eye on any accounts associated with your child's identity and on any school-related communications that seem out of the ordinary.
On the question of protecting your own network traffic and online activity—which is a separate consideration from this breach but relevant context for families thinking about digital privacy—a VPN can shield your household's browsing and connection data from third-party observation. If that is something you are evaluating, our introduction to how VPNs work is a reasonable starting point, and PremierVPN's personal VPN plan covers multiple devices on a single subscription. It will not undo a credential breach at a testing contractor, but it is one layer of household privacy hygiene worth understanding.
The Structural Problem Is Not Going Away
The ETS breach is likely to be followed by others like it, not because any particular organisation is negligent, but because the architecture of how student data flows through third-party systems creates persistent exposure. Dozens of vendors hold detailed records on millions of children, many of those records go back years, and the families affected rarely know the vendors exist.
Meaningful improvement requires action at the policy and procurement level—stronger contractual security requirements, mandatory breach detection timelines, shorter data retention windows, and clearer public disclosure of which vendors hold which data. Parents can advocate for those changes through school boards and district administrators.
In the meantime, the practical advice is straightforward: assume your child's records exist in more places than you know, take the credit freeze step proactively, and treat any unusually specific communication about your child's school life with healthy scepticism. The ETS incident is a clear illustration that the data already left the building—the question now is how to limit the damage and push for systems that make four-month undetected intrusions structurally harder to sustain.
For further reading on why data privacy matters beyond individual breaches, our piece on what a genuine no-logs policy involves explains the data-minimisation principles that apply equally to VPN providers and, arguably, to any organisation entrusted with sensitive personal records.
