On October 16, 2026, Educational Testing Service (ETS) began notifying California students and families after student files were copied from its file-transfer site. ETS provides assessments for the California Department of Education (CDE). The notice says an unauthorised party used compromised SFTP access between May 22 and September 18.
The case illustrates a practical vendor risk for smaller organisations: access at a contractor can reach information entrusted by its customers. An encrypted transfer connection still requires protection of the account authorised to use it.
A file-transfer account used to copy records
ETS says it identified unauthorised activity on September 25. It disabled the account and took the SFTP site offline. CDE’s communication describes a replacement site with stronger security controls.
The reviewed public information does not establish how the initial access was compromised. Attributing the incident to phishing, password reuse or a specific SFTP vulnerability would therefore go beyond the evidence.
Student records are distinct from student passwords
The files included identity details, contact information, student identifiers and assessment results. Depending on the individual, disability and programme-participation information could also be involved.
ETS specifically excludes passwords and financial information. The credential used by the intruder to access the transfer site must be distinguished from the information inside the files. The notice includes students enrolled during the three preceding school years, without providing a numerical total of affected individuals.
Why a vendor breach can reach its customers
A school district can send information to ETS without its own systems being compromised. Irvine Unified School District makes that distinction in its family notification: the incident affected the state’s contractor, not IUSD’s local systems.
Ally’s independent incident analysis also identifies unknowns, including how the compromised access was obtained. Those gaps still leave an operational question worth asking: which files can a transfer account read and copy, and how would unusual use be detected?
For families receiving a notification
Use the CDE website to read the ETS notice and review the two years of identity protection offered to affected students. Do not provide additional information about a child in response to an unexpected call, text or email referring to their assessments.
Irvine’s warning highlights these approaches. Knowing the school name or testing context does not, by itself, make a message legitimate. The breach does not justify claiming that families’ passwords were exposed.
For organisations entrusting files to vendors
Use the case to review transfer access involving payroll, training or administration providers. Identify the owner of each account, the directories it can reach and the process for disabling it. These recommendations are not findings about weaknesses in ETS’s contracts.
Plan for separate accounts, limited permissions and transfer-log review. Ask vendors how they would detect an unusual copy and help identify the files involved. Transport encryption does not withdraw the permissions of an account used by an unauthorised party.
How Soclyde relates to this case
In a small team, several colleagues may need access to vendor portals. Soclyde lets them organise those credentials in an encrypted vault on their devices and share access through Premium, reducing copies in messages and documents.
That role concerns your organisation’s secrets. Soclyde does not monitor ETS transfers, remove files already copied or replace a vendor’s access controls. Permissions must be adjusted in each service.
Key points
The ETS case distinguishes a compromised access credential from the student information copied. Families should follow the official notification; organisations should understand what each vendor account can reach. See our guide to sharing passwords in a team to organise those access details.
