An unauthorized party obtained student information stored on a secure file transfer protocol (SFTP) server belonging to the Educational Testing Service (ETS) through repeated logins from May 22 to Sept. 18. The leaked data varies from person to person, but could include home addresses, race, disability status, and necessary accommodations. Students received an email from the District explaining the data breach after the California Department of Education (CDE) alerted SUHSD of the leak on Oct. 16.
Students use the ETS’ Secure Test Browser for standardized tests such as the California Assessment of Student Performance and Progress (CAASPP), as it locks down student devices by preventing them from having other applications open during testing. The state specifically uses the information stored on the SFTP server to exchange statewide testing information.
This incident is not directly related to the District and is affecting students across California, including those who enrolled in state high schools within the past three years.
“ETS, following regular web monitoring, has not uncovered any evidence that the information has been made public,” CDE State Superintendent of Public Instruction, Tony Thurmond, wrote in a CDE News Release on Oct. 16. He explained that Social Security numbers, passwords, parent or guardian information, and financial account information were not involved in the security breach.
In response, the ETS took the SFTP server offline and began building a new site with increased security measures. They are also offering two years of free Experian IdentityWorks—a program that monitors inquiries, activity, and trades involving identity information online—to protect affected students.
Numerous statewide organizations, including the California Cybersecurity Integration Center, the California Department of Technology, and the California Governor’s Office of Emergency Services, are also working to assess the incident, partnering with cybersecurity experts, monitoring information use, and reaching out to those affected.
