Educational Testing Service (ETS), the nonprofit contractor that supports California’s statewide testing programs, has begun notifying students and families after an unauthorized user copied files from an ETS secure file-transfer site. California’s Department of Education said the incident affected information held for students enrolled during the three previous school years; the records and fields involved vary by person. [1] [2]

According to the state’s notice, ETS identified unauthorized activity on Sept. 25. Its investigation found that a compromised login credential was used at various times from May 22 through Sept. 18 to access the site and copy files. The exposed information may include names, dates of birth, addresses, student identifiers, demographic and program-participation details, disability-related information and assessment records. [1] [2]

The state says the copied data did not include Social Security numbers, financial account information, passwords or parent and guardian information. ETS has taken the affected file-transfer site offline and built a replacement with additional security controls. CDE said notifications began Oct. 16 and are expected to continue into early November. [1] [2]

What is known—and what remains uncertain

California and ETS said they had not found evidence that the information had been made public as of the notice. That does not establish that no misuse occurred; it describes what the investigation had found at that point. Reuters reported that the incident involved data for millions of students, but the state’s public notice says the specific information varies by individual and does not give a single verified total of affected records. [1] [3]

ETS is offering affected current and former students two years of identity-protection services at no cost. The state has also posted a detailed notice and resources for families in multiple languages. [1] [2]

The incident illustrates the reach of a third-party system that supports public testing: a credential compromise at the contractor’s file-transfer site exposed a broad set of student records, including sensitive education and disability information. CDE says it is reviewing the incident and coordinating with state cybersecurity partners and the vendor. [1] [2]

Sources