Coverage from Tech Radar indicates that a significant data breach has compromised the sensitive personal information of millions of current and former California public school students. The incident involved a third-party partner, the Educational Testing Service, which manages student data for the California Department of Education.
The breach occurred within a Secure File Transfer Protocol system. Attackers gained unauthorized access repeatedly over four months, from May 22 to Sept. 18, before the activity was discovered on Sept. 25. While the Educational Testing Service has not disclosed an exact figure, officials estimate that students enrolled over the past three years may be affected. With approximately 5.7 million students enrolled annually, the total number of impacted individuals could reach 17 million. Investigators believe the breach resulted from compromised credentials rather than a software vulnerability. The stolen data includes names, addresses and dates of birth. In response, the Educational Testing Service and the California Department of Education are notifying affected individuals and providing 24 months of free identity protection services. The organization has since implemented enhanced monitoring and strengthened access controls to prevent future incidents. Currently, there is no evidence that the stolen information has been released publicly, and no ransom demands have been reported. This event highlights the ongoing security risks associated with third-party vendors handling sensitive educational records.
Source: Tech Radar
