Hackers used one stolen login to vacuum up the names, addresses, disability records, and demographic data of roughly seven million current and former California public school students — because a government contractor was sitting on a database it never should have had in the first place.
The breach, announced Friday by the California Department of Education, traces back to Educational Testing Service, the nonprofit that runs the state's mandated standardized assessments. ETS discovered the hack on September 25. The unauthorized party had been copying files at various times between May 22 and September 18 using nothing more than a compromised credential for an SFTP site. One username. One password. Four months of access to millions of children's records.
The exposed data includes student names, addresses, dates of birth, grade levels, unique state identifier numbers, schools attended, gender, race and ethnicity, primary language, country of origin, English learner status, disability information, and eligibility for federal programs such as those for low-income families. Social Security numbers, financial information, and parent data were not compromised, officials said.
The Los Angeles Times reported that the breach affects far more than California's current 5.7 million public-school students — it reaches back to 2023 enrollments, and students who left the state without confirming a transfer date to 2006. The New York Post put the figure at 7 million, covering all students enrolled over the past three years.
Neither outlet pressed hard on why a testing contractor needs to warehouse country of origin, disability status, or income-eligibility data in the first place. The answer is simple: the state required it. California mandates these assessments and demands that demographic detail accompany every score. ETS just held the bag — and dropped it.
Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute, put it plainly:
