2026 ETS — CA statewide-testing SFTP; three prior school years copied

Data compromised

All students enrolled in the three previous school years (CDE: >5.7M enrolled 2025–26) plus possibly more. May include name, DOB, residential address, school/district/grade, SSID/local ID, gender/race/ethnicity, language, disability/504, program eligibility (Title I, McKinney-Vento, military), ELPAC/CAASPP results. No SSNs, DLs, passports, financials, cards, or passwords. No parent PII. Not found published as of the notice. Unique headcount unpublished. recordsAffected 0.

Technical writeup

Root cause

Compromised login credential used against an ETS SFTP site that exchanged California statewide assessment files with CDE. Access at various times 22 May–18 Sep 2026; ETS found it 25 Sep, disabled the account, and took the site offline.

References

• https://www.cde.ca.gov/nr/in/ets-notification.asp
• https://oag.ca.gov/system/files/Notice%20of%20Data%20Breach_3_Redacted.pdf