The School Data Vault Had a Contractor Key Under the Mat

California has supplied another lovely demonstration of public-sector efficiency: one contractor credential, one file-transfer site, and a student-data inventory measured in school years.

The California Department of Education’s October 16 notice says an unauthorized party used a compromised login credential to access an Educational Testing Service secure file-transfer site at various times between May 22 and September 18. ETS identified the activity on September 25, disabled the account, took the site offline and began an outside-assisted investigation.^[1]

The copied files included information on all students enrolled in the three previous school years. The categories vary by person but may include names, birth dates, home addresses, schools, districts, grade levels, state and local student identifiers, gender, race or ethnicity, language and country-of-origin data, English-learner status, disability and Section 504 status, testing accommodations, disability type and participation in programs tied to homelessness, migrant education, military families and Title I.^[1]

That list is a phishing kit with a school calendar.

The limits matter too. California says Social Security numbers and sensitive financial information were not accessed. ETS says it has not found that the copied information has been made public. Neither statement proves the data cannot be misused later. Neither is permission to announce identity theft that has not been established.^[1][2]

ETS is offering two years of identity-protection services. California agencies are reviewing the incident, the contractor’s security and contractual compliance, while state cyber responders support forensics. An October 2 letter said normal enrollment-data processing and some testing activity had been paused.^[1][2]

The institutional failure is not that a contractor existed. Statewide testing requires data exchange. The failure question is why one account could reach this much sensitive material across this many students and years, and what segmentation, retention and monitoring were supposed to stop it.

“We disabled the account” is the beginning of the incident report. The useful answer shows which folders the account could reach, which controls fired, why the copying continued for months, and which records no longer need to be kept in the same blast radius.

What evidence should a school contractor have to produce before it earns access to child data at this scale?

Artwork: conceptual AI-generated editorial illustration; contains no real student or personal record.