Single Compromised SFTP Credential Exposed Records of 5.7 Million California Students Since 2006

Educational Testing Service maintained an SFTP site under its CAASPP and ELPAC testing contract with the California Department of Education. The site held enrollment, demographic, disability, English-learner, and test-score records. Monitoring detected the first unauthorized sessions in late May; the account remained active until September 25 when ETS disabled it and took the server offline. No evidence of public posting has surfaced, and the files contained no SSNs or financial data. Procurement records show ETS's contract requires only password-protected SFTP access without mandatory MFA or outbound logging to CDE systems. Similar single-credential exposures have occurred in other state education vendors, including the 2024 Canvas LMS incident where stolen tokens allowed bulk data pulls. The absence of independent forensic reports leaves open whether the credential was phished, reused from a prior breach, or obtained via supply-chain access. The breach demonstrates that one low-privilege account can still exfiltrate comprehensive longitudinal student profiles covering disability status, McKinney-Vento eligibility, and military-connected designations. State education agencies continue to rely on legacy file-transfer methods despite repeated incidents at K-12 contractors. Replacement infrastructure announced by ETS will need verifiable audit logs and per-file access controls to prevent recurrence. CDE began notifying families on October 16 and offered two years of identity monitoring. County superintendents received advance notice on October 2. Next indicators to watch are whether ETS publishes a post-incident report with access logs and whether California updates its testing contracts to require hardware-bound credentials and continuous monitoring.