Hackers steal personal records of millions of California students in massive third-party breach
The California Department of Education (CDE) has disclosed a severe supply-chain cybersecurity breach exposing sensitive personal data belonging to roughly 7 million current and former California public school students. The breach occurred at New Jersey-based non-profit Educational Testing Service (ETS), a key state vendor that administers standardized testing programs across California.
According to state officials, unauthorized threat actors used stolen administrative credentials to lurk inside ETS systems undetected for nearly five months between May 22 and September 18, copying student data files at various intervals.
Scope of Compromised Records and Third-Party Risk
The intrusion exposed comprehensive demographic and educational records for virtually all students enrolled in California public schools over the past three school years, alongside select historical records dating back to 2006.
Key details regarding the breach and compromised datasets include:
Exposed Data Fields: Exfiltrated files contained student full names, home addresses, dates of birth, demographic markers, school enrollment details, and sensitive disability status records.
Excluded Data Types: CDE confirmed that Social Security numbers and financial details were not part of the breached datasets, and no records have appeared publicly on dark web monitoring forums so far.
Protracted Dwell Time: Security experts noted that the threat actors operated inside ETS infrastructure for nearly five months using a single set of compromised login credentials before detection systems flagged the unauthorized activity on September 25.
Assessment Disruptions and Containment Measures
Following the discovery, ETS temporarily suspended normal enrollment data processing and assessment activities, prompting CDE to issue advisories to district and county school officials outlining steps to mitigate operational disruptions.
In response to the incident, ETS implemented enhanced technical safeguards:
Access & Credential Controls: Enforced stricter multi-factor authentication requirements and restricted administrative access pathways across assessment infrastructure.
Heightened Network Monitoring: Deployed automated behavioral monitoring tools to detect anomalous data transfer volumes and unauthorized file copying across state repositories.
Third-Party Security Audits: Retained external forensic cybersecurity teams to conduct comprehensive code and architecture reviews across its testing environments.
Supply Chain Vulnerabilities in Educational Infrastructure
The breach highlights persistent third-party security risks facing public school systems across the United States. While state education departments delegate testing, logistics, and data analytics to outside vendors, centralized repositories create high-value targets for threat actors.
As state and federal regulators review vendor oversight policies, the incident underscores the urgent need for strict credential governance, shorter access lifespans, and automated data-exfiltration monitoring across public sector IT contractors.
