California’s testing system is now the center of one of the largest education data exposures the state has seen. The California Department of Education (CDE) confirmed that an unauthorized party used a compromised login credential to access a secure file-transfer site operated by Educational Testing Service (ETS), the nonprofit contractor that administers portions of the state’s standardized assessments, and copied files containing student information. CDE said the access ran from May 22 through September 18, 2026, and that the intrusion was identified on September 25, 2026, meaning the unauthorized party had a roughly four-month window inside the system before anyone caught it.
That breach itself, detailed in an earlier report on the ETS breach timeline, is only half the story. The more consequential question now facing California schools, parents, and the ed-tech industry is what happens next: who is liable, what the state’s own privacy statutes require, and whether a single compromised credential at a testing vendor should be enough to expose years of student records. This piece looks past the initial disclosure and into the regulatory, contractual, and legal terrain the breach now sits on.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
According to CDE’s official statement, the investigation determined that an unauthorized party used a compromised login credential to access the site and copy files containing California student information at various times between May 22 and September 18, 2026. The affected population includes California students enrolled during the three previous school years, not just students currently enrolled, which widens the exposure considerably beyond a single academic year.
The Shattered Newsletter
The week’s biggest stories in tech, gaming and security, in one email.
Free, once a week. Unsubscribe any time.
The categories of data potentially accessed include student names, dates of birth, residential addresses, schools, districts, grade levels, Statewide Student Identifiers (SSID), local student identifiers, demographic information, English-learner status, disability and Section 504 status, testing accommodations, program eligibility, English-language proficiency information, and statewide assessment registration, participation, and results where applicable. CDE and ETS have both said the breach did not involve Social Security numbers, driver’s-license numbers, passport numbers, financial-account information, credit or debit card numbers, account passwords, or parent and guardian personal information.
Politico and the Los Angeles Times both reported the incident as affecting data tied to millions of California students, a scale that outstrips most prior education-sector breaches in the state. CDE has not published a specific confirmed total number of affected students in its official notices, leaving a gap between the reported scale and any officially confirmed figure. ETS has stated it has not found evidence that the accessed information was made public, though absence of evidence on a public leak site is not the same as absence of a copy sitting on an attacker’s own infrastructure.
Most state breach-notification laws, including California’s own, are built around a narrow definition of personal information that triggers mandatory notification: Social Security numbers, driver’s license numbers, financial account numbers paired with access codes, and similar hard identifiers. Because ETS and CDE have both said those categories were not involved, the breach sits in a legal gray zone where notification obligations may be less automatic even though the practical harm to families, particularly those with children in special-education or English-learner programs, can be significant.
Disability status, Section 504 accommodations, and English-learner designations are the kind of data that privacy advocates have long argued deserves the same protection as financial identifiers, because they can be used for targeted harassment, discrimination, or social-engineering attacks against families rather than direct financial fraud. California’s SB 923, which expands CCPA deletion rights starting in 2027, points to where state lawmakers are already heading on this question, even though that bill was not written with this specific incident in mind. The ETS breach is likely to become a reference point in debates over whether California’s definition of sensitive student data needs to catch up with what large-scale assessment vendors actually collect.
FERPA, the federal student-privacy law, adds another layer. FERPA generally applies to records maintained by schools and their authorized agents, which would include a contractor like ETS performing services on behalf of CDE and local districts. FERPA enforcement, however, runs through the U.S. Department of Education’s complaint process rather than a private right of action, meaning families cannot sue directly under FERPA even if a violation is found. That structural limit is part of why state-level statutes and class-action theories under state law tend to carry more immediate financial consequences for a vendor than a FERPA finding alone.
Laid out in order, the dates CDE has confirmed show how long the exposure ran before anyone outside the attacker’s own access logs knew about it. On May 22, 2026, an unauthorized party first used a compromised login credential to reach the ETS-operated secure file-transfer site. From that date through September 18, 2026, CDE says the party accessed and copied files containing California student information at various times, not necessarily continuously, but across roughly four months. The intrusion was identified on September 25, 2026, a full week after the last confirmed unauthorized access, which suggests detection came from a review process or an external signal rather than real-time alerting inside the file-transfer system itself.
CDE’s public notice followed in mid-October, with Politico, the Los Angeles Times, and US News all publishing coverage around October 16, 2026, roughly three weeks after identification. That gap between internal identification and public disclosure is fairly typical for breaches involving forensic investigation, legal review, and coordination between a vendor and a state agency, but it also means affected families were living with an unknowing exposure for nearly five months total before the first public reporting appeared.
CDE’s own language is specific on the entry point: a compromised login credential, not a software vulnerability, not a misconfigured server, and not a supply-chain exploit. That detail matters because it shifts part of the conversation toward identity and access management rather than patching. A four-month dwell time between May 22 and September 18 before detection on September 25 suggests the file-transfer site either lacked anomaly detection on login patterns, lacked multi-factor authentication enforcement on a credential with that level of access, or both.
ETS spokesperson Christine Betaneli said: “ETS maintains a comprehensive information security program that is regularly assessed by third parties,” and added: “We continuously invest in safeguarding the systems and data we maintain,” according to reporting from Education Week. Betaneli also said: “We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices,” describing the organization’s response to the incident.
Separately, Educational Testing Service said in a statement: “ETS takes the security of student information with the utmost seriousness, and sincerely regrets that this incident occurred,” as reported by the Epoch Times. Those statements track a familiar post-breach script: assert an existing security program, then announce the specific controls that were apparently missing before the incident. Enhanced monitoring and strengthened access controls are not unusual commitments after a credential-based breach, but they also imply that monitoring and access controls were not strong enough to catch four months of unauthorized file copying before detection on September 25.
The California Department of Education said: “We are taking this incident extremely seriously, working with state cybersecurity experts, and reviewing ETS’s compliance with its data security obligations,” according to the agency’s statement reported by Politico. That review matters because it determines whether ETS faces contractual penalties, a renegotiation of its data-handling terms, or a longer-term risk to its standing as a state testing vendor. California’s testing contracts with assessment vendors typically include data security riders that specify encryption, access logging, and breach-notification timelines; a finding that ETS fell short of those terms could expose the company to contract remedies separate from any civil litigation.
ETS is not a small or obscure player. It is one of the largest assessment organizations in the country, administering tests tied to K-12 and higher-education programs across multiple states, not just California. A finding of inadequate security controls in California carries weight well beyond this one contract, because other state education departments with their own ETS-administered testing programs will be watching how CDE’s review concludes and what remediation it demands.
California has not announced financial penalties or a settlement figure tied to the ETS incident, and any number at this stage would be speculation. But recent breach settlements elsewhere in 2026 give a sense of the range outcomes tend to fall into once litigation and regulatory processes run their course. AT&T’s $177 million breach settlement saw individual payouts capped around $7,500 per affected customer, tied to a breach involving far more sensitive financial and account data than what ETS has disclosed. Connecticut’s medical data breach, which hit 62,871 people, produced a $2.7 million settlement, a useful comparison point because medical data, like disability and accommodation records, sits outside the traditional SSN-and-financial-data notification trigger yet still drew a meaningful settlement.
Florida’s state motor vehicle agency breach, covered across several reports including one on the FLHSMV’s September 4 confirmation, offers a government-agency parallel: a state-run program relying on a third-party system, a single compromised access point, and a notification process that unfolded over weeks rather than days. The ETS case follows a similar shape, with CDE acting as the public-facing agency while the technical fault sits with an outside operator.
The table above is not a prediction of where the ETS case lands financially. It is a reminder that even breaches without Social Security numbers or financial-account data have produced multi-million-dollar settlements once litigation and regulatory review run their course, largely because the harm theory shifts from direct financial fraud to privacy violation, discrimination risk, and breach of contractual duty.
Standardized testing in the United States runs almost entirely through a small number of large assessment vendors: ETS, along with a handful of competitors that administer state and national exams, college admissions tests, and English-proficiency assessments. School districts and state education departments do not typically build their own secure file-transfer infrastructure; they rely on vendors like ETS to operate it, which concentrates risk into a small number of high-value targets holding years of student records across many states at once.
That concentration is structurally similar to what security researchers have flagged in other sectors relying on a narrow set of shared vendors, where a single compromised credential at one company can cascade into exposure across dozens of otherwise unrelated customers. The difference in education is that the “customers” are state agencies and school districts, and the people whose data is exposed, students, often have no contractual relationship with the vendor and no way to opt out of participating in state-mandated testing.
Local school districts, including Irvine Unified and Menlo Park City School District, have published their own notices directing families to CDE and ETS communications rather than issuing separate guidance, a pattern consistent with how multi-district vendor breaches typically unfold: the vendor and the state agency own the notification process, while individual districts largely redirect inquiries. That approach is efficient for districts but can leave parents without a clear single point of contact if they have specific questions about their own child’s data.
Because Social Security numbers were not involved, standard advice to freeze credit may not apply in the way it would for a financial-data breach. The more relevant family-level risk is targeted phishing or social-engineering attempts that reference a child’s real school, grade level, or disability status to appear more convincing, something that is harder to defend against with a credit freeze and instead requires basic skepticism toward unsolicited calls, texts, or emails referencing a child’s school records.
Education-sector breaches have followed a consistent pattern for years: districts and state agencies outsource core functions, including testing, grading, and record-keeping, to third-party vendors, and those vendors become the actual point of failure when something goes wrong. The sector has historically lagged behind finance and healthcare in security investment relative to the sensitivity of the data it holds, partly because school budgets prioritize instructional spending over IT security, and partly because the regulatory penalties for education-data breaches have generally been smaller than those in finance or healthcare.
The ETS incident, given its scale and the sensitivity of disability and accommodation data involved, may become a turning point in that calculus if CDE’s review results in meaningful contractual penalties or if California lawmakers use it as the basis for new legislation specifically covering education-vendor data security, rather than relying on the general CCPA framework that SB 923 is already extending.
ETS operates largely as a nonprofit, so there is no public stock price to move, but the reputational and contractual stakes are still significant. State testing contracts are typically multi-year and competitively bid, and a security review finding real gaps could affect ETS’s position when California or other states next put assessment services out for bid. Competing assessment vendors, along with cloud-based ed-tech platforms that handle similar student data categories, are likely to face new security questionnaires and audit requirements from state education departments in the wake of this incident, regardless of whether their own systems were ever at risk.
Cybersecurity vendors serving the education sector, including identity and access management providers focused on credential monitoring and anomaly detection, are positioned to benefit from the renewed attention, since the root cause CDE identified, a single compromised credential going undetected for months, is exactly the failure mode those tools are built to catch. Security researchers at Malwarebytes have flagged the incident as part of a broader pattern of credential-based attacks against organizations holding large pools of personally identifiable information with inconsistent access monitoring.
Cyber-insurance underwriters have increasingly priced education-sector policies based on how many third-party vendors a district or state agency relies on, rather than just the district’s own IT footprint, because incidents like the ETS breach show that the weakest link in the chain is rarely the school system itself. A vendor the size of ETS, handling testing data for multiple states, likely carries its own cyber-liability coverage, but the scope of that coverage, and whether it extends to regulatory fines, contract penalties, and third-party lawsuits filed by affected families, will shape how quickly any compensation reaches the people whose data was exposed.
Contractual indemnification clauses between CDE and ETS will also determine who absorbs costs tied to notification, credit or identity-monitoring services if offered, and legal defense. Public agencies like CDE typically negotiate indemnification language specifically for this scenario, but whether California’s existing contract with ETS anticipated a breach of this specific scale and sensitivity, affecting disability status and testing accommodation records rather than more conventional identifiers, is the kind of detail that only becomes clear once the state’s compliance review and any resulting litigation play out. Insurers and plaintiffs’ attorneys watching the case will be looking closely at whether ETS’s own security assessments, the ones Betaneli described as conducted regularly by third parties, flagged any of the gaps that ultimately allowed four months of undetected access.
Beyond the ETS-specific review, this incident is a reasonable prompt for any school district or state education department to revisit its vendor security questionnaires for every third party that touches student records, not just testing companies. The practical questions worth asking include whether multi-factor authentication is enforced on every credential with access to bulk student data, whether file-transfer systems log and alert on unusual access patterns, and whether the vendor’s incident-response plan includes a defined maximum detection window rather than an open-ended commitment to “ongoing monitoring.”
A four-month gap between unauthorized access beginning and detection is the kind of timeline that security teams in finance and healthcare would treat as a major control failure requiring board-level disclosure. Education has not historically applied the same standard, and the ETS breach may be the incident that forces that comparison into the open.
What organization was breached, and when was it discovered?
Educational Testing Service (ETS), under contract with the California Department of Education, confirmed unauthorized access to a secure file-transfer site. CDE said the intrusion was identified on September 25, 2026.
How long did the unauthorized access last?
CDE said the unauthorized party accessed and copied files between May 22 and September 18, 2026, a window of roughly four months before detection.
Were Social Security numbers or financial information exposed?
No. CDE and ETS both said Social Security numbers, driver’s-license numbers, passport numbers, financial-account information, card numbers, and account passwords were not involved.
What student data was potentially accessed?
Names, dates of birth, addresses, schools, districts, grade levels, Statewide Student Identifiers, demographic data, English-learner status, disability and Section 504 status, testing accommodations, and statewide assessment results where applicable.
How many students are affected?
CDE has not published a specific confirmed total. Several outlets, including Politico and the Los Angeles Times, have reported the breach affects data tied to millions of California students, though an exact figure has not been officially confirmed.
Has the accessed data been published or sold?
ETS has said it has not found evidence that the accessed information was made public, as of CDE’s most recent statement.
Does FERPA give parents the right to sue ETS directly?
No. FERPA enforcement runs through a complaint process with the U.S. Department of Education rather than a private right of action, which is why state-law claims and regulatory contract reviews are the more likely avenues for consequences.
What should parents do if they are concerned about their child’s data?
Because financial identifiers were not exposed, a credit freeze is less relevant than staying alert to phishing attempts that reference a child’s real school, grade, or accommodation status, and routing specific questions through official CDE or district breach-notification channels rather than unsolicited contacts.
The Shattered Newsletter
The week’s biggest stories in tech, gaming and security, in one email.
Free, once a week. Unsubscribe any time.
Dr. Elena Marchetti writes about cryptography and the math that underpins it: hash functions, collision attacks, and why algorithms age out of trust. She has a research background in applied cryptography and tests a claim before explaining it.
Independent explainers on cryptography, security, privacy and the technology behind provably-fair systems. Home of the original SHA-1 collision research.
The Shattered Newsletter: the week’s biggest stories in tech, gaming and security.
About the Author
