HackingEducationEducationStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)EducationMinorMediumContained

EDUCATIONAL TESTING SERVICE

bd_bc97dac5d172ecbe · schema v1 · pii pii-v2

Severity

Medium

Discovered

Sep 25, 2026

Filed

Oct 16, 2026

To disclose

21 days

Affected

Not disclosed

Confidence

68%

Full breach record for EDUCATIONAL TESTING SERVICE →3 incidents on file

Educational Testing Service (ETS) notified California students and families of unauthorized access to student data via a compromised SFTP account. An external actor used stolen credentials to access and copy student demographic, program participation, and assessment data between May 22, 2026, and September 18, 2026. ETS discovered the incident on September 25, 2026. The data did not include SSNs or financial information. ETS has contained the incident, rebuilt the SFTP site, and is offering 2 years of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 126 days

discovery → filing · 21 days

May 22, 2026

Begins

Sep 25, 2026

Discovered

Oct 16, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Educational Testing Service
norm: educational testing service

Name: EDUCATIONAL TESTING SERVICE
norm: educational testing service
Industry: Educationllm

Discovered: Sep 25, 2026
Breach occurred: May 22, 2026 – Sep 18, 2026
Undetected for: 126 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)EducationMinor
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified California Department of Education (CDE)California Cybersecurity Integration Center (Cal-CSIC) assisting with digital forensics and incident response supportCalifornia Department of Technology (CDT) and California Governor’s Office of Emergency Services (Cal OES) supporting the state’s technical, legal, and operational response
Initial access: valid_credentials

During the incident: Disabled the account involved
Took the affected SFTP site offline
Initiated an investigation with the assistance of external cybersecurity experts
Notified appropriate law enforcement agencies
Building an entirely new SFTP site with enhanced security controls
Providing complimentary identity-protection services through Experian IdentityWorks for 2 years
Changes made: Enhanced the security of the SFTP site
Building an entirely new SFTP site with enhanced security controls
Evaluating additional security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-631485
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 16, 2026
Raw hash: f1a0552b483472657db89b09bc70daf19fa40283da131b41315c22683ce5ff88

Reporting entityEducational Testing Service

Victim entityEDUCATIONAL TESTING SERVICE

Incidentdiscovered Sep 25, 2026

Stated responseDisabled the account involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov