ETS says a login copied California student files from 22 May; found 126 days later, no student count stated

126 days from the first date to discovery, and no count of students

The Educational Testing Service (ETS), a nonprofit that tests California's public-school students under contract to the State, says that an unauthorised party used "a compromised login credential at various times during the period from May 22, 2026 to September 18, 2026" to copy files containing student information from a secure file transfer protocol (SFTP) site. ETS says it identified the unauthorised activity on 25 September. That is 126 days after the first date in the period (derived). The notices reached families on 16 October, 147 days after the first date and 21 days after identification (derived).

Two cautions go with the arithmetic. The span from 22 May to 18 September is 119 days (derived), but it is the outer limit of a period, not a measure of access: the notice says the credential was used "at various times" within it, and gives no count of days, sessions, files or bytes. And 126 days is a gap between a first date and a discovery date, not a measured dwell time, because the notice does not say whether anyone looked for activity before 22 May.

The figure most readers want is not in the notice. It states no number of students, files or records, no cause for the compromised credential and no actor. Press coverage carries numbers, and they do not all come from the same place: Politico attributes "7 million" to the California Department of Education (CDE), Reuters quotes CDE's one-year enrolment of more than 5.7 million, and the Los Angeles Times says "millions". The count section below sets out who states what.

This briefing is built on the 10-page Notice of Data Breach that ETS, "at the direction of" CDE, filed with the California Attorney General. It was read in full on Saturday 17 October 2026 from 20:49 BST. CDE's own pages sit behind a web-firewall alert that redirects scripted requests to a warning page. That is a bot check and it was not bypassed. So CDE's statements are read here through the AG-filed notice, through an Internet Archive capture of CDE's 2 October letter to districts, and through press reports that quote CDE. Each press report is labelled secondary where it appears.

What was hit: stated and not stated, line by line

The notice is a letter to families with a credit-freeze guide attached, not an incident report, and its dated facts are few. The table sets what it states against what it leaves out. Quotations are from the notice unless a row says otherwise.

What the Notice of Data Breach filed with the California Attorney General states and does not state. Read in full, 10 pages, on 17 October 2026, with the AG listing page that carries it.

Question	Stated in the notice	Not stated
What system?	"an ETS secure file transfer protocol (SFTP) site", "used to exchange California statewide assessment information with CDE". CDE's 2 October letter says "ETS-operated systems".	Product, hosting or name; whether any CDE system or any other ETS system was reached; who administered the site.
How was it entered?	"a compromised login credential", one. ETS "disabled the account involved".	How it was compromised; whose it was (a person, a CDE user, a service account); whether a second factor, a key or an address limit existed.
When?	Used "at various times during the period from May 22, 2026 to September 18, 2026". Identified 25 September.	Days, sessions or files in the period; whether earlier activity was sought; why the period ends on 18 September; how ETS identified the activity on 25 September.
What was taken?	Files "accessed and copied", holding student demographic, program participation and assessment data, with the fields listed (name, date of birth, address, school, district, grade, student identifiers, demographics, disability and Section 504 status, programme eligibility, registration and results).	The number or volume of files; which years lie beyond "the three previous school years"; what each file held.
Whose data?	"California students, including but not limited to all students enrolled in the three previous school years". It "varies by individual".	Any count; how "three previous school years" is defined; how many are former students; whether any recipient now lives outside California.
What was not in it?	No Social Security, driver's licence or passport numbers, no financial account, card or password data, and no parent or guardian information.	How ETS checked the files to be sure of the exclusions.
Published or sold?	ETS, after "regular web monitoring", has "not uncovered any evidence that the information has been made public". It "has taken steps to reduce the potential risk".	What the monitoring covers; what the steps were; whether any demand or claim has been received.
Who did it?	"an unauthorized party".	Any actor, motive or claim of responsibility.
What changed?	Account disabled, site taken offline, "an entirely new SFTP site with enhanced security controls" built; outside experts engaged; law enforcement notified.	Which controls; which agencies; what the controls were before.
What are the State bodies doing?	CDE and the State Board of Education are "reviewing the incident and ETS's compliance with applicable data security and contractual requirements". The California Cybersecurity Integration Center assists with forensics; the Department of Technology and the Governor's Office of Emergency Services support.	A date or outcome for the review; any remedy or penalty.
Other ETS programmes?	Not addressed.	Whether any other ETS programme, customer or test-taker (TOEFL, GRE, Praxis, UK candidates) is affected.

Three drafting details bear on how the notice should be read. First, the California Attorney General's list files the incident under "CDE", with breach date 22 May 2026 and reported date 16 October 2026. A search for ETS on that list finds nothing, because the entity named is the State agency, while the notice is written in ETS's voice. Second, the notice prints no letter date, although the identity-protection terms run "for 24 months from the date of this letter". The 16 October date rests on the AG list and on press reports. Third, the adult enrolment deadline appears with two years: 19 March 2027 in the body, and 19 March 2029 in the adult attachment, where the body gives 2029 as the outer date for minors who turn 18. A family should confirm the deadline through the contact route the notice gives rather than rely on either date. The notice also carries state-specific paragraphs for residents of 18 jurisdictions (derived, counted from the notice). That is ordinary template language for a letter that may reach people who have since moved, and it does not state that anyone outside California is affected.

The count: who states a number, and the notice states none

The notice's only description of the population is "California students, including but not limited to all students enrolled in the three previous school years". It gives no number. The table sets out every figure read in coverage, whose words it is and what it measures. All of these are secondary except the first row, because CDE's own release was behind the firewall.

Who states a student count or a comparison, read on 17 October 2026. Quotations are the outlets' own words or the words they attribute to CDE.

Source, and how it was read	Words and figure	Whose number it is
ETS notice filed with the California AG (primary)	"including but not limited to all students enrolled in the three previous school years". No figure.	None. On its wording the three-year group is a floor, not a total.
Reuters, 16 October (secondary, syndicated copy)	CDE quoted: "all students enrolled in the three previous school years". Separately: "More than 5.7 million students were enrolled in California during the 2025-2026 school year, according to the department."	CDE's own figure for one year's enrolment. It is a denominator, not a count of those affected, and the quoted CDE words leave out "including but not limited to".
Politico, 16 October (secondary, read as syndicated on Yahoo)	"all 7 million students enrolled in California public schools over the past three school years were exposed in the breach, the CDE said".	Politico attributes it to CDE. It is not in the notice, in Reuters or in the Los Angeles Times. CDE's release could not be read to check it.
California Post, 16 October (secondary, on Yahoo)	"7 million California public school students"; "Politico reported".	A repeat of Politico.
Just the News, 16 October (secondary)	"7 million students enrolled in California public schools over the past three school years", in the outlet's own voice. The word "enrolled" links to Politico.	A repeat of Politico, unattributed in the text.
Los Angeles Times, 16 October (secondary)	"millions"; "many more than the state's current 5.7 million public-school students"; the breach "dates back to 2023 enrollments"; students who left California without a confirmed transfer, "dating back to 2006".	The paper's own words. It names no document for 2006, and the notice does not contain it.
Cybernews, 17 October (not read)	A search listing shows the headline "Millions of California student records breached, some dating back to 2006".	Not checked. The page returned a Cloudflare check to scripted requests and was not bypassed.

Four readings follow. The first two come from the record, the third is derived and the fourth is inference.

The 7 million is Politico's attribution, and nothing read confirms it at source. Reuters, writing from the same CDE announcement, gives the 5.7 million enrolment and the "three previous school years" wording but no total. The Los Angeles Times gives no total. The California Post and Just the News both lead back to Politico. If CDE did publish 7 million, it is on a CDE page this briefing could not read.

A CDE figure of 7 million would be a floor on the notice's own words. "Including but not limited to" makes the three-year group the part the notice commits to naming, not the limit. The Los Angeles Times's 2006 line, if it reflects a CDE statement, would widen the group; the notice does not carry it, and the paper names no source for it.

5.7 million is not an affected count. It is one year's enrolment. The ratio of 7 million to 5.7 million is 1.23 (derived). That says only that a three-year group is about 23 per cent larger (derived) than one year's enrolment if both figures are right. It is not a check on either.

Students, records and files are different units. The notice says files. The Cybernews headline says records. The other outlets say students. A student can sit in several files and a file can hold many students, so a figure in one unit cannot be turned into another without the file list, and the notice does not give it. This is inference.

The timeline: five dates, with every interval derived

The diagram draws the first strip to scale and the five dates below it in order. Every day count is worked out with Python's datetime module (calc.py) and is labelled derived wherever it appears. The dates come from the notice (22 May, 18 September, 25 September), from CDE's letter to districts (2 October) and from the California AG list and press reports (16 October).

The intervals between the dates, derived on 17 October 2026 with Python datetime (calc.py, output in calc-output.txt).

Interval	Days (derived)	What it is, and what it is not
22 May to 18 September	119	The outer span of the stated period. Not 119 days of continuous access: the notice says "at various times". Counting both end dates it is 120 calendar days.
18 September to 25 September	7	From the last date in the period to identification. The notice does not say whether access ended or was stopped.
22 May to 25 September	126	First date to discovery: the interval in the title. A gap between two dates, not a measured dwell time.
25 September to 2 October	7	Identification to CDE's letter to districts. The date ETS told CDE is not stated.
2 October to 16 October	14	CDE's letter to the notices.
25 September to 16 October	21	Identification to notices and the AG filing.
22 May to 16 October	147	First date to notices.
16 October to 19 March 2027	154	From the notice date (taken from the AG list, since the letter prints none) to the enrolment deadline in the body of the notice.

Three points on the dates. First, the 2 October letter, signed by CDE's Deputy Superintendent of Public Instruction and addressed to county and district superintendents and charter school administrators, says ETS "has informed" CDE and the State Board of "an incident involving ETS-operated systems" and that ETS halted "normal enrollment data processing" and paused "certain testing activities". It does not mention copied data. The first source read that says files were copied is the 16 October notice. Second, the Archive capture of the letter page is dated 13 October and shows "Last Reviewed: Friday, October 2, 2026" and a list entry "added 02-Oct-2026", while the Los Angeles Times says district leaders received word on 2 October and that the first public notice was 16 October. The record read does not settle whether the letter page was publicly visible on 2 October. Third, all five dates fall on a Friday (derived), so the four intervals are whole weeks: 17, 1, 1 and 2, and the 147 days from first date to notices are 21 weeks. That establishes nothing about cause.

Seven labels, and what the record shows behind each

A label, comforting or alarming, is not a measurement. Seven appear in this story. The first five are ETS's own labels, in the notice or from its spokesperson. The last two are outside labels that part from the notice.

Labels in the story, where each appears and what the record shows.

Label	Where it appears	What the record shows
"secure" file transfer protocol	The notice	The notice says a login credential was used. A protocol that protects a connection does not decide who may log in, so the label says nothing about the control that mattered. What failed is not stated.
"compromised login credential"	The notice	One credential and "the account involved". How it was compromised, whose it was and what protected it are not stated.
"no evidence" the information "has been made public"	The notice	ETS's finding after "regular web monitoring". The same notice says the files were copied. Not made public is not the same as not held by the party that copied them.
"a comprehensive information security program" that is "regularly assessed by third parties"	An ETS spokesperson, quoted by the Los Angeles Times	A statement about a programme. The notice describes one credential used within a period whose outer span is 119 days (derived). An assessment of a programme is not evidence about any single account.
"identity protection"	The notice	The data listed has no Social Security numbers, yet the minors' package includes a Social Security number trace and the attached guide explains credit freezes. The notice's own warning is about unexpected messages that cite a student's school or assessments. Whether the offer covers the risks the copied data carries is a judgement for families.
"stolen", "hack", "hackers"	Los Angeles Times, California Post, Just the News; Reuters says "hacker"	The notice says "accessed and copied" and "an unauthorized party". Whether one party or several, and whether anything was sold, is not stated.
"CDE"	The California AG list	The organisation listed is the State agency. The notice is in ETS's voice, and a search of the list for ETS finds nothing.

The interests are plain. ETS is the contractor and CDE is the contracting authority that says it is reviewing ETS's compliance, so each statement about the incident comes from a party with a stake in how it is judged. ETS told Reuters it has implemented "additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices". Monitoring and access controls are what an outside reader would ask about first. The notice does not say what existed before.

Who said what

Statements by source, read on 17 October 2026. Press quotations are secondary.

Who	What they say	What it rests on
ETS, in the notice	Identified unauthorised activity on 25 September. One compromised credential used at various times from 22 May to 18 September. Files accessed and copied. No evidence made public. A new SFTP site built.	ETS's own investigation with outside experts. No report or findings are published.
An ETS spokesperson, to Reuters, Politico and the Los Angeles Times	ETS "maintains a comprehensive information security program"; it has "implemented additional safeguards"; no other "ETS customers" were affected (the Times's paraphrase).	Press statements. The customers line is a paraphrase and the only statement found on other customers.
CDE, in a letter of 2 October to district leaders	ETS informed CDE and the State Board of "an incident involving ETS-operated systems"; ETS halted "normal enrollment data processing" and paused "certain testing activities".	An Internet Archive capture of 13 October. The letter does not mention copied data.
A CDE spokesperson, to Politico	CDE is "reviewing ETS's compliance with its data security obligations".	A statement quoted by Politico.
State bodies, in the notice	CDE, the State Board, the California Cybersecurity Integration Center, the Department of Technology and the Governor's Office of Emergency Services are working on the response.	The notice.
Outlets, in their own voice	"stolen"; "7 million" (via Politico); 2006; and that "hackers will often keep information confidential pending the outcome of a ransom demand", with the note that the official release did not say whether a demand was made.	Not in the notice. The ransom sentence is the Los Angeles Times's reasoning, not a finding.
A university cybersecurity academic, quoted by the Los Angeles Times	A stolen credential "should not become a months-long passport" to student records, and the question is why safeguards failed, with the caveat "If that is what happened here".	A conditional comment, not an account of this incident.
Any actor	None found. No claim of responsibility, no data for sale and no ransom demand appears in any source read, as at 21:10 BST on 17 October 2026.	Web searches on 17 October. One breach-news site returned a block to scripts and was not read.

"None found as of 21:10 BST on 17 October" is a statement about what could be searched then, not about whether a claim exists. If one appears it will be an allegation by an unverified party, and it should be set beside the notice's own wording: copied, not made public as of ETS's monitoring.

Other regulators, ETS's own site and ETS's other customers

Public breach-listing pages were read between 20:54 and 21:00 BST on 17 October for an entry under ETS, Educational Testing Service or CDE. Nothing was submitted to any of them.

Public listing pages read on 17 October 2026 for an ETS or CDE entry.

Listing page	What was read	Result
California Attorney General	The current page of recent entries, newest 10/16/2026.	One entry: CDE, breach date 05/22/2026, reported 10/16/2026, with the notice attached. No count is listed.
Texas Attorney General	662 entries, the latest published 10/16/2026, read in a browser tab and searched.	No entry for "Educational Testing" or "California Department". A search for "ETS" matched one unrelated company.
Vermont Attorney General	Entries dated 17 April to 16 October 2026.	No ETS or CDE entry.
Oregon Department of Justice	Latest entry dated 8 October 2026.	No entry. The list predates the filing, so it says little.
Washington Attorney General	Latest entry dated 11 September 2026.	No entry. The list predates the filing, so it says little.
Maine Attorney General	The page states that its public-facing database is offline.	Not readable.
New Hampshire Department of Justice; Massachusetts	Both returned 403 to a scripted request.	Not read, and not bypassed.

ETS's own site. The ets.org home page and newsroom, read as static pages at 20:56 BST, carry no statement about the incident. The newsroom list loads dynamically, so that is weak evidence. The CAASPP results site, reached at an ets.org address, carries none either. The only ETS statements found are the spokesperson's to the press.

ETS's other programmes and test-takers. The notice is about California's assessment programmes and does not address ETS's other products or test-takers, including TOEFL, GRE, Praxis or candidates in the UK. An ETS spokesperson told the Los Angeles Times that no other "ETS customers" were affected. That is ETS's own statement, relayed in a paraphrase, and whether individual test-takers count as customers is not stated. Treat it as unverified.

UK schools, trusts, councils, exam bodies and suppliers: what the guidance says

UK law did not apply to this incident and nothing here claims it did: the notice is a California filing about California students. The reason for a UK section is the shape of the exposure: a supplier-run transfer site, one credential, years of children's files, and a gap of 126 days (derived) between the first stated date and the supplier's awareness. The table sets out what UK guidance says about each part, as read on 17 October 2026.

UK guidance as read on ico.org.uk, gov.uk and ncsc.gov.uk on 17 October 2026. The right-hand column is this briefing's reading.

Source	What it says	Why it matters here
ICO, Personal data breaches: a guide	A notifiable breach goes to the ICO "without undue delay, but not later than 72 hours after becoming aware of it". A processor "must inform you without undue delay as soon as it becomes aware" (Article 33(2)). Organisations should have "robust breach detection".	The clock starts at awareness. A supplier's 126 days before awareness (derived) sit outside it, so the contract and the supplier's detection are where the exposure is.
DfE, Cyber security: core standard (England)	MFA "must be enabled" for staff accounts with access to cloud services or remote access, and for IT administrative accounts. IT support works with third-party cloud suppliers "to check that they are also meeting these standards by performing supplier assessments".	Covers a school's own staff accounts and its supplier checks, not a supplier's transfer account.
Cyber Essentials requirements v3.3, April 2026	Accounts the organisation owns are in scope "even when those accounts are used by a third party". "authentication to cloud services must always use MFA". MFA for "accounts that are accessible from the internet".	Speaks of your accounts and your cloud services. A supplier's own transfer site is not named, and whether it counts is a scoping question for the assessor.
NCSC, MFA for your corporate online services (v2.0)	"You should mandate strong MFA for every user accessing sensitive data." Re-authentication when a request comes from an abnormal place or performs an abnormal action.	Written for workforce access. An automated exchange account may not be able to complete MFA, so ask what replaces it.
NCSC, supply chain security: principle 5 and principle 10	Set minimum security requirements for suppliers and put them in contracts. Require upward reporting of security performance and build in a right to audit.	The contract route to the questions in the checklist below.

For scale only: 126 days is 3,024 hours, or 42 times the 72 hours (derived). The comparison is not a finding against anyone. The UK 72 hours runs from becoming aware, ETS says it became aware on 25 September, and California's rules were not read for this briefing. What the figure measures is how long a supplier's account could be used before any party was aware, which a contract clause or an audit right cannot see unless it asks about detection. The 21 days from identification to notices are 504 hours, 7 times 72 (derived), and again not a UK comparison: UK law separates the controller's report to the ICO from telling individuals.

Earlier briefings on this site looked at school suppliers. Frontline Education's breach letters were first reported 48 days after it found a flaw, and Bromcom, a UK supplier of school management systems, reached its first dated public post 18 days after it found a legacy sign-on breach.

What to do, in the order worth doing

These are this briefing's own questions for suppliers. None is a finding about ETS, whose notice does not say which of these controls existed. Where a UK page supports a step, the item says so.

What could not be verified

• CDE's own pages. The news release (yr26rel45), the incident page, the notification page and the /ets landing page, and the 2 October letter at its CDE address, each redirected scripted requests to a web-firewall alert (HTTP 303). That is a bot check and it was not bypassed. The Internet Archive had a readable capture only of the 2 October letter (13 October 2026). The other captures it returned were the firewall page or none, and its availability service was offline at 20:50 BST.
• Politico and Cybernews. Both returned a Cloudflare check to scripted requests. Politico's text was read as syndicated on Yahoo; Cybernews was not read at all. DataBreaches.net was not read. Nothing is cited from it.
• Reuters. Read as a syndicated copy on a US radio station's website. The wire's own page was not read.
• The 7 million. Whether CDE published it is not verified. It rests on Politico's attribution.
• The 2006 line. Not in the notice. The Los Angeles Times states it without naming a document.
• The letter date. The notice prints none. 16 October rests on the AG list and press reports.
• Other ETS customers. The only statement found is an ETS spokesperson's, in the Los Angeles Times's paraphrase.
• Regulator lists. New Hampshire and Massachusetts returned 403 and were not read; Maine's database is offline; Oregon's and Washington's lists end before the filing.
• Cause, whose credential, sessions, files, actor. Not stated in any source read.

The question that exposes the gap

If one login to a supplier's transfer site copied your pupils' files at various times over four months, which log would show it, who reads that log, and would the first alert come in fewer than 126 days?

Key facts