On October 16, 2026, the California Department of Education confirmed something every parent in the state dreaded hearing. An outsider had spent months inside a file transfer system run by Educational Testing Service, the nonprofit that runs California's statewide student testing, and copied files full of student records. Notification letters started going out that day and will keep arriving through early November. News reports put the number of affected students in the millions, although the state has not published an official count.
The part that should stop every business owner in Los Angeles cold is not the size. It is how ordinary the way in was. Nobody broke encryption or used an exotic exploit. Someone had a working username and password, and the system let them in, again and again, for almost four months.
What happened inside the ETS file transfer system
According to the official incident notice from the California Department of Education, an unauthorized party used a compromised login credential to reach a secure file transfer site that ETS operated. The site existed for one job: moving statewide assessment data back and forth between ETS and the state. The intruder accessed and copied files at various times between May 22 and September 18, 2026. ETS identified the activity on September 25, disabled the account, took the site offline, and built a replacement with stronger security controls.
Do the math on those dates. Roughly four months of access, then another week before anyone noticed, then three more weeks before families heard a word. That gap between the first break in and the first alarm is where most of the damage in a modern breach happens, and it is exactly the gap a well run IT operation is designed to close.
What information was taken, and what was not
The state says the records varied by student but could include names, dates of birth, home addresses, school, district and grade, the Statewide Student Identifier, demographic details such as primary language and country of origin, disability and Section 504 status, testing accommodations, program eligibility, and test registration and results. The department says Social Security numbers, driver's license numbers, bank and card information, account passwords, and parent or guardian information were not involved.
That sounds reassuring until you think about what a criminal can do with a child's name, birth date and home address. It is the starter kit for a fake credit file, a convincing scam call to the parents, or a phishing email that knows exactly which school your child attends. Disability and accommodation details are some of the most private facts a family has, and once they are copied, nobody can put them back.
One more detail deserves attention. The notice says the files covered students from the three previous school years, plus former students who left a California school as far back as 2006 without a confirmed transfer. Records from twenty years ago were still sitting where an intruder could reach them. Data you no longer need is data that can still be stolen.
Five protections that would have changed the outcome
We do not know every detail of the ETS environment, and the state has said it is reviewing ETS's compliance with its data security and contract requirements. But the public facts point to gaps we see all the time in small and mid size businesses, and each one has a known fix.
The first is a login that a password alone cannot open. When a stolen username and password is enough to get into a system that holds sensitive files, the system is one leaked credential away from a breach. Phishing resistant MFA on every remote entry point, including file transfer servers, VPNs, and email, turns a stolen password into a useless string of characters.
The second is knowing when your credentials leak. Passwords usually escape long before they are used, through reused logins, old breaches, or infostealer malware on someone's home computer. Ongoing dark web monitoring watches for your company's accounts showing up in criminal markets so you can reset them before someone tries them.
The third is someone actually watching the logs. A file transfer account that suddenly downloads far more than usual, at odd hours, from an unfamiliar location, is a loud signal. Without alerting and a person who reviews it, that signal goes nowhere for months. This is what managed detection and response is for: catching the unusual pattern in days instead of seasons.
The fourth is keeping less. A written data retention policy decides how long each type of record stays and makes sure old files are deleted or moved offline on schedule. If records from 2006 had been archived away from a live transfer server, they could not have been copied from it.
The fifth is treating vendors as part of your security, because they are. ETS was a contractor, and the data belonged to the state's students. Your outside bookkeeper, payroll service, practice management software, or document scanning company may hold your most sensitive records too. Third party risk management means asking every vendor how they protect logins, how fast they detect intrusions, and how long they keep your data, then putting the answers in the contract.
Why this matters for a law firm, medical office, or private school in Los Angeles
It is tempting to read a story like this and think it only happens to big organizations. The opposite is closer to the truth. Large institutions at least have security teams. A twenty person law firm or a busy dental practice often has a shared login to the scanner portal, a file sharing link that never expires, and a former employee whose account still works. Attackers know that, and they go where the doors are unlocked.
California also takes this seriously. The state's breach notification law requires businesses to notify affected residents when certain personal information is exposed, and medical practices carry HIPAA obligations on top of that. A breach costs money, but the bigger cost is the phone calls from clients and patients who trusted you with their information.
What California families should do right now
If your child attended a California public school in recent years, watch your mail for a letter from ETS. The letter contains an activation code for two years of free identity protection through Experian IdentityWorks, with a separate plan for minors, and the state says the enrollment deadline is March 19, 2027. You can confirm the details and the support phone number on the Department of Education's incident page, where the notice is available in many languages.
Be suspicious of any unexpected call, text, or email that mentions the breach, ETS, the Department of Education, or Experian. The department itself warns families not to share Social Security numbers, passwords, or bank information in response to messages they did not ask for. Criminals love a headline, and a real breach is the perfect cover for a fake "verification" call. Consider a free credit freeze for your children with the three credit bureaus, which stops anyone from opening credit in their name.
A quick self check for your business
Ask yourself a few honest questions. Can anyone log in to your email, file sharing, or remote access with only a password? Would you know within a day if an account downloaded thousands of files at two in the morning? Do you know which of your passwords have already appeared in a breach? When was the last time you deleted client or patient records you no longer need? Could you name every outside company that holds your sensitive data, and how each one protects it? Do former employees and old vendors still have working accounts? If the answer to any of these makes you hesitate, you have found the same kind of gap that let an intruder spend four months inside a system holding millions of student records. Our guide to secure onboarding and offboarding covers that last one in detail.
How GlobeVM helps close these gaps
For 30 years, GlobeVM has run and secured IT for businesses across Los Angeles, and the protections above are not extras for our clients. Multifactor sign in, endpoint protection, email filtering, and firewall management come standard in every plan. We add dark web monitoring so leaked passwords get reset before they are used, around the clock monitoring so unusual activity gets a human response, and practical help writing retention policies and reviewing the vendors who touch your data. When you call, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners.
If this story made you wonder about your own setup, that instinct is worth listening to. Call us at (818) 405-9930 or request a free IT and security assessment, and we will show you exactly where your doors are locked and where they are not.