Attackers spent about four months inside a file-transfer system run by a vendor to California's education department, and the state says students enrolled in the past three years could be affected.
The vendor is Educational Testing Service (ETS), a third party the California Department of Education uses to manage student information. Its Secure File Transfer Protocol (SFTP) system, a standard way to move large files between organizations, was accessed repeatedly between May 22 and September 18. The attackers opened and copied files containing names, addresses, dates of birth and more. ETS discovered the activity on September 25.
ETS has not said how many students are affected. California's public schools counted more than 5.7 million students in the 2025-2026 year alone, and the state believes the previous three years of enrollees could be involved. That works out to roughly 17 million if each year was the same size. Treat that as a ceiling: a student enrolled throughout appears in every year, so the count of distinct people is probably lower.
The entry point appears to be compromised credentials rather than a software flaw, though the specific method has not been shared. ETS and the state are notifying affected people and offering 24 months of free identity protection. Nothing found so far suggests the data has been published, and no ransom demand has surfaced. ETS said in a statement that it has added "enhanced monitoring, strengthened access controls, and further third-party review of our security practices."
That list of fixes hints at where the gaps were. A stolen login that works again and again for four months suggests nobody was watching how it was used.
The 24-month offer also sits awkwardly against the data involved. A child's birth date and home address do not expire on a two-year schedule, and the people affected will carry that exposure into adulthood.