Stolen Passwords Expose Data of 17 Million California Students

Four months of undetected access inside an SFTP server

Intruders accessed student data repeatedly between May 22 and September 18 before anyone noticed.

The intrusion targeted a Secure File Transfer Protocol (SFTP) server operated by Educational Testing Service (ETS), a prominent non-profit contractor that manages assessment and student data for the California Department of Education. According to reporting from Malwarebytes, unauthorized actors repeatedly logged into the server over nearly four months, systematically copying files before security teams discovered the anomalous activity on September 25.

The breach was not the result of a zero-day exploit or sophisticated infrastructure hijacking. Instead, investigators found the attackers simply logged in using compromised credentials. The exact method used to acquire the login details remains undisclosed, but the attack underscores how basic identity hygiene failures routinely undermine critical public sector vendors, reminiscent of incidents where a fake WatchGuard VPN site stole admin logins to access internal networks.

Up to 17 million students exposed across three academic years

While ETS has not confirmed an official victim tally, state education officials estimate that the exposure spans three academic years. California's public school system recorded over 5.7 million enrolled students in the 2025–2026 school year alone. If the data covers three full cohorts without major overlap deduplication, as many as 17 million current and former students could have their records compromised.

The stolen files contain sensitive personally identifiable information (PII), including student names, home addresses, dates of birth, and Statewide Student Identifiers (SSIDs). While this is not the corporate scale seen when a Burger King Japan breach leaked 11M app user records, student data carries unique risks: minors rarely monitor credit reports, making their clean records prime targets for long-term synthetic identity fraud.

What it means for affected families

The California Department of Education and ETS are currently rolling out formal notifications to affected individuals and families across the state. Those impacted are being offered 24 months of complimentary identity protection and credit monitoring services.

State officials confirmed there is currently no evidence that the copied databases have surfaced on illicit dark web markets, nor has ETS received an extortion or ransomware demand. Families who receive a formal breach notification should take advantage of the offered monitoring and place an immediate freeze on their child's credit file with the major credit bureaus.

With state officials working through notification lists, the incident serves as a stark reminder that data retention policies and vendor access controls require constant audits. Letting unmonitored credentials expose four months of minor data is a failure California will spend years rectifying.