A compromised login at Educational Testing Service exposed records belonging to millions of California students, turning a contractor file-transfer system into a large-scale privacy incident.
The affected data varies by individual but may include names, student identifiers, dates of birth, addresses, demographic information, disability-related information and assessment records. Financial account information and passwords were not reported as part of the exposed material.
The breach highlights how much sensitive information can accumulate outside the institutions that originally collected it. Schools and public agencies routinely depend on specialist vendors for testing, analytics and learning services, concentrating large datasets in a small number of external systems.
That makes supplier security more than a procurement checklist. Organisations need to understand exactly what data a contractor receives, how long it keeps it, which accounts can reach it and whether unusual bulk access would be detected quickly.
The case also shows why a “secure file transfer” label is not enough on its own. Strong encryption cannot compensate for a compromised account with excessive access, weak monitoring or unnecessary retention of old records.