Your contractor holds your data, and the ETS notice shows the risk

What the ETS notice confirms#

This third party data breach began at Educational Testing Service, a nonprofit under contract with California to run statewide assessments. ETS identified unauthorised activity on 25 September 2026 involving a secure file transfer protocol site used to exchange assessment information with the Department of Education. The notice says an unauthorised party used a compromised login credential to copy files at various times between 22 May and 18 September 2026. ETS then took the affected SFTP site offline.

The scope runs wider than the current roster. The department says the copied information covered all students enrolled in the three previous school years, and it reaches former pupils who did not confirm transfer to another school. The Los Angeles Times calls it the theft of personal data of millions of California students. Read together, the two sources show that a contractor's copy of the records can outlast the enrolment it describes.

The notice lists what was taken, and the list is specific. It includes student name, date of birth, residential address, school and grade, statewide identifiers, disability and Section 504 status, and eligibility for named programmes. The notice also says the files did not include Social Security numbers, and that the incident did not involve parent or guardian personal information.

The timing is the part a buyer should scrutinise. Counting from the published dates, access ran for 119 days, ETS identified activity 7 days after the last access on 18 September, and the families' notice followed 21 days after that identification. Those are calendar sums from the notice dates. The notice does not describe ETS's internal controls in detail, so the sums say nothing about why access went unnoticed for as long as it did.

Third party data breach: who is responsible#

A third party data breach separates the people who own the data from the people who hold it. The notice says ETS maintains the records in connection with California's statewide assessment programmes, under contract to the state. Responsibility therefore runs in two directions: the vendor answers for its controls, and the buyer answers for the contract and the oversight it sets.

The notices leave fault open. CDE and the State Board of Education say they are reviewing ETS's compliance with applicable data security and contractual requirements. ETS reports that web monitoring has not uncovered any evidence that the information has been made public. That is a result to date, not a guarantee, and the notice does not claim more.

Third party data breach examples#

Third party data breach examples tend to share one feature: the vendor is trusted with records the buyer cannot easily see. This case is useful because the vendor is an assessment body rather than a software reseller, and because the data is about children. A buyer reading the notice can take three lessons: how long access ran, how long detection took, and what the notice had to say once it went out.

Vendor risk: what to check#

The contractor question is the one most organisations skip. CISA describes the ICT supply chain as including third-party vendors, suppliers, service providers, and contractors, and warns that hackers and criminals can target government and industry through the contractors, sub-contractors, and suppliers at all tiers of that chain. A transfer site run by a vendor is a direct case of that exposure.

CISA puts the point in one line: a supply chain is only as strong as its weakest link. The FTC's business guidance asks the same question from the buyer's side, beginning with Know what personal information you have and asking who else touches it. Finance law runs the same way: the Gramm-Leach-Bliley Act requires firms to explain their information-sharing practices to their customers and to safeguard sensitive data. That duty does not stop at the contractor's door.

For a security vendor writing about a third party data breach like this, the honest answer to who is responsible is that the vendor and the buyer share the risk, and in edtech security the buyer is often a school district. The notice shows the vendor side in detail. The buyer side, which is the contract and the oversight, is where a security firm can offer the most useful questions, and cybersecurity marketing work starts with exactly those questions.

Follow the trail the notices leave, and the pattern is plain. The incident did not start on 25 September, when ETS first saw unauthorised activity. The recorded access window opens on 22 May, and it ran through the summer until ETS identified it on 25 September. A third party data breach often works like this: a quiet prowl through a system that everyone assumes is shut. The fox in the picture is the patient one, because the damage is done in the undergrowth long before the alarm sounds.

The ETS case also shows what a usable notice contains. The state's letter to school administrators calls it a Vendor Incident Report. The incident notice describes ETS as a nonprofit assessment organization under contract to provide state testing. Buyers can use that structure as a template for their own vendor clauses: who was affected, what was taken, what the vendor has changed, and who to call.

A third party data breach is as much a question of access as of encryption. Think about the den the records were kept in. Each student's file sat on a transfer site run for the state, and the copies that left it were made at various times over four months. A buyer who asks only whether the vendor encrypts data at rest has missed the question that matters here, which is who could log in, how often, and from where. Access logs, login rotation and alerting on unusual downloads are the cunning checks that catch a third party data breach early.

Two further checks are worth writing into a contract. First, know what software and hardware sit between your records and the vendor, which CISA frames through the 2026 Updates to Minimum Elements for a Software Bill of Materials. Second, know who inside the vendor can reach the files, and remove access the moment it is no longer needed. CISA's ICT Supply Chain Program Basics page is a sensible starting point for the second check.

A third party data breach notice is also a scent for the next attacker. Once families know which fields were copied, a phishing message that mentions a school, an assessment or a grade becomes far more believable. The ETS notice warns about exactly this, telling people to be wary of unexpected emails, texts or calls that reference a student's school or statewide assessments. Vendors that hold children's records should treat the notice as a planning document for the follow-on scams, not only as a legal step.

For affected families, the notice's own advice is the practical part. Adults can request a free credit report at annualcreditreport.com and may place a security freeze, and the notice pairs the record with a two year identity protection offer. A buyer's lesson is that the vendor's notice has to be as usable as the one families actually read. For more on how a folkfox client reads a notice like this, see the latest news stream.

Procurement teams often ask whether a vendor has suffered a third party data breach before, which is a poor test. A clean history can mean a vendor is good at detection, or that it has not yet looked hard enough. The better questions are how the vendor would find out, how fast it would tell you, and what it would hand over. Ask for a worked example of its last incident response, with dates, and compare the answer with the ETS timeline above.

None of this makes the state the villain or ETS the only one at fault. The notice describes a vendor that took the site offline, rebuilt it with stronger controls, and worked with law enforcement and cybersecurity experts. The open question is the one the state has said it is reviewing: whether ETS met its data security and contractual obligations before the access began. A buyer should treat that review as the test case for its own contracts, and read the outcome closely when it lands.

Five checks for security buyers#

Each check below is a clause a buyer can write this week. None needs the vendor to admit fault first, which keeps the conversation practical.

Frequently asked questions#