California student data breach may affect up to 17 million

A breach involving an SFTP system used by Educational Testing Service (ETS) may have exposed sensitive information belonging to millions of current and former California public school students. The system supports student information management for the California Department of Education.

According to Malwarebytes, attackers repeatedly accessed and copied files between May 22 and September 18. The activity was discovered on September 25. The files contained names, addresses, dates of birth and other personal information. The report says the attackers are believed to have used compromised credentials, rather than a software vulnerability; the specific attack method has not been disclosed.

ETS has not said how many students were affected. California public schools counted more than 5.7 million students in the 2025–2026 school year. The state education department believes students enrolled during the previous three years could also be affected; if enrollment was equal in each year, that would amount to about 17 million students.

ETS and the department are working to notify affected people, who are being offered 24 months of identity protection software at no cost. The report says there is no known evidence that the stolen information has been made public and no apparent ransom threat. ETS said it had added safeguards, including enhanced monitoring, stronger access controls and further third-party reviews of its security practices.