California student data breach at ETS hits millions of students

Attackers accessed an SFTP system at Educational Testing Service, a partner of the California Department of Education, and copied files with names, addresses and birth dates. The intrusion ran from May 22 to September 18 and was discovered on September 25; up to 17 million students over three years may be affected. Access came via compromised credentials.

• Attack ran May 22 to September 18, discovered September 25
• California had 5.7M students in 2025-2026; up to 17M affected
• Cause was stolen credentials, not a software flaw
• Affected individuals get 24 months of free identity protection