Hacker copies records of millions of California students via contractor ETS login
Breach ran four months before discovery, state distributes breach notice in 27 languages while reviewing the vendor's own compliance
Images
The California Department of Education in Sacramento on April 18, 2022. John Fredricks/The Epoch Times
zerohedge.com
A hacker copied the records of millions of California students through a compromised login at Educational Testing Service, the nonprofit contractor that handles assessment data for the state's Department of Education. ETS began notifying affected families on October 16, weeks after discovering unauthorized activity on a secure file-transfer site used to share student data with Sacramento.
The breach ran from May 22 to September 18, according to the department's notice. Someone used stolen credentials to copy files covering students enrolled across three consecutive school years, including the current one in which more than 5.7 million students are enrolled in California. The copied material includes names, dates of birth, addresses, schools, grade levels, Statewide Student Identifiers, demographic details, disability status and assessment records. Social Security numbers, financial account information, passwords and parent details were, by the department's account, not involved.
ETS says it disabled the account, took the site offline, engaged outside cybersecurity firms and built a replacement with stronger controls. The department is now distributing ETS's Notice of Data Breach to families — available in 27 languages — and reviewing whether the contractor met its data security and contractual obligations.
The pattern is familiar to California school districts. In September 2022, hackers accessed roughly 2,000 sensitive student records at Los Angeles Unified, and a ransomware group published the data after Superintendent Alberto Carvalho refused to pay. Long Beach Unified disclosed a separate leak of student identification numbers, names and email addresses.
In each case, the data was collected by public institutions and exposed through the systems built to manage it. The state's remedy for a contractor breach is to ask the contractor to write a notice, translate it 27 ways, and review its own compliance. The students whose disability status and addresses now sit in someone else's copy carry that exposure for the rest of their lives.