On Sept. 25, ETS identified unauthorized access to and copying of student data on a secure file transfer website used to exchange California statewide assessment information with the California Department of Education. The CDE contracts with ETS to provide the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).

According to ETS, an unauthorized party used a compromised login credential at various times from May 22 to Sept. 18 to access the file transfer site to copy files containing California student information.

Information about all students enrolled in at least the three previous school years was accessed and copied. The student information may include student name, date of birth, residential address, school, district, grade level, gender, race or ethnicity, and eligibility status.

Student data does not appear to be leaked to the dark web yet, according to ETS CEO Janet Garcia, who appeared on the Oct. 21 episode of ACSA’s Legislative Lunch Break.

Because ETS does not have e-mail addresses for students, the organization is asking LEAs to voluntarily assist in notifying students or parents about the data breach. In an Oct. 16 letter to district and county leaders, ETS requested assistance reaching students more quickly and offered compensation for each student an LEA contacted with the official Notice of Data Breach.

Updates on the incident are available at www.cde.ca.gov/nr/in/ets-incident.asp.