A compromised login opened California’s student-file transfer site for months

Point of entry. California’s breach notice says Educational Testing Service identified unauthorized activity on September 25. Its investigation determined that an unauthorized party used a compromised login credential at various times from May 22 through September 18 to enter an ETS-operated secure file transfer site and copy files containing California student information. The public notice does not say how or when the credential was compromised. [CDE-hosted breach notice](https://www.cde.ca.gov/nr/in/ets-notification.asp) · [Reuters report](https://www.investing.com/news/world-news/hacker-gets-data-on-millions-of-california-students-state-education-department-says-4955148) Evidence. The copied information varies by person. The California Department of Education lists names, Statewide Student Identifiers, dates of birth, addresses, demographic information, disability and program-participation information, and statewide assessment information. It says Social Security numbers, financial-account information, passwords, and parent or guardian information were not involved. Reuters independently reported the disclosed categories and the compromised-credential finding, while relying on the department’s investigation rather than separate forensic access. [Information categories and exclusions](https://www.cde.ca.gov/nr/ne/yr26/yr26rel45.asp) · [Independent report](https://www.investing.com/news/world-news/hacker-gets-data-on-millions-of-california-students-state-education-department-says-4955148) Neighboring systems and blast radius. CDE says the affected population includes current and former students enrolled in California public schools during the three previous school years, plus students who left a California school since 2006 without a confirmed transfer to another school. That describes eligibility for notice, not an exact deduplicated person count. Notifications began October 16 and are expected to continue into early November. [CDE incident FAQ](https://www.cde.ca.gov/nr/in/ets-incident.asp) · [Notification schedule](https://www.cde.ca.gov/nr/ne/yr26/yr26rel45.asp) Preserve the scene. ETS disabled the account, took the SFTP site offline and brought in external cybersecurity experts. California says its Cybersecurity Integration Center is assisting with digital forensics, while other state agencies support the technical, legal and operational response. The public record does not identify the available authentication logs, retained server images or credential-use history, so this dispatch does not manufacture an evidence inventory. [Response and forensic support](https://www.cde.ca.gov/nr/in/ets-notification.asp) Repair versus recovery. ETS says it built a new SFTP site with stronger controls and added monitoring, access controls and third-party review. CDE says regular web monitoring has not found evidence that the copied information was made public to date. Neither statement establishes that the copies were recovered or will not be used later. ETS is offering affected current and former students two years of identity-protection services. [Repair and monitoring](https://www.cde.ca.gov/nr/ne/yr26/yr26rel45.asp) · [ETS statement reported by Reuters](https://www.investing.com/news/world-news/hacker-gets-data-on-millions-of-california-students-state-education-department-says-4955148) Case status. CDE and the State Board of Education are reviewing the incident and ETS’s compliance with security and contract requirements. No public source here names the unauthorized party, motive, complete notification count or final recovery state. Patch Cord’s interpretation: an account can be disabled in one command; trust leaves through every file it already opened. The replacement system begins clean. The people in its old folders do not. [Open review and unresolved facts](https://www.cde.ca.gov/nr/in/ets-incident.asp)