October 16, 2026: The Educational Testing Service (ETS), contractor for the California Department of Education, disclosed a data breach affecting 7 million current and former K-12 students (data spanning back to 2006). Unauthorized access to an SFTP server via compromised credentials exposed names, birthdates, addresses, disability records, student ID numbers, demographics, grade levels, school information, and English learner status. Canonical: ets-california-schools-breach2026. Source: California Department of Education.
What happened
An attacker obtained a single login credential for ETS's SFTP server and used it to access student records from May 22 through September 18, 2026 — nearly four months of undetected unauthorized access. ETS discovered the breach on September 25, 2026, disabled the compromised account, and took the SFTP site offline. The California Department of Education publicly disclosed the incident on October 16, with ETS engaging external cybersecurity specialists for forensics.
Technical analysis
The breach involved a single compromised SFTP credential — likely obtained via phishing, credential reuse, or password spraying. SFTP (SSH File Transfer Protocol) is a secure file transfer mechanism, but a single weak or reused password can compromise all files on the server. The four-month access window suggests the breach was not caught by automated monitoring or anomaly detection systems.
Data exposed: Student names, birthdates, home addresses, disability status, unique student ID numbers, demographics (gender, race/ethnicity), grade levels, school and district names, primary language, country of origin, English learner status. NOT exposed: Social Security numbers, financial information, payment data.
Impact
Scope: 7 million current and former California K-12 students from the past 3 years, with some records dating back to 2006. This is one of the largest education-sector breaches on record, affecting children and families statewide.
Risks: Identity theft (attackers have names, birthdates, addresses for minors), phishing (scammers can pose as school officials), targeted social engineering, and fraud. Disability records are particularly sensitive — they can be used for extortion or discrimination. English learner status reveals immigrant families, which could expose them to targeting.
Children's data is valuable on the dark web because they have clean credit histories and long lives ahead for fraudsters to exploit. The combination of name, birthdate, address, and student ID is sufficient for opening accounts in a child's name.
What to do
- Enroll in free identity protection: ETS and CDE are offering free identity-theft monitoring and credit monitoring for three years. Sign up via official CDE channels.
- Monitor credit reports: Request free annual credit reports from Equifax, Experian, and TransUnion. Watch for new accounts opened in your child's name.
- Consider a credit freeze: For minors, freezing credit prevents new accounts from being opened without thawing the freeze. Contact all three bureaus.
- Watch for phishing: Ignore emails claiming to be from CDE or ETS asking to verify account information. Call the official number from your school district's website.
- Monitor school records: Periodically review your child's school account for unauthorized changes to address, emergency contact, or other details.
Related reading
See education sector breach prevention.