One Login, One File Transfer Site, Four Months

The public details of the Educational Testing Service (ETS) breach are brief. According to the California Department of Education (CDE), an unauthorized party used a compromised login credential to access an ETS-operated SFTP site that carried statewide assessment data to and from the department. Files were copied at various times between May 22 and September 18, 2026, and ETS identified the activity on September 25. The files covered millions of current and former California students, including every student enrolled in the state’s public schools over the past three school years.

What hasn’t been disclosed matters just as much. Officials haven’t said how the credential was obtained, what kind of account it belonged to, or which controls were in place. ETS says its security program “is regularly assessed by third parties,” and the investigation is ongoing. This article doesn’t try to fill in those blanks.

The facts that are public, though, point to a part of the environment that often gets less scrutiny than core applications: the systems that move data between organizations. Each disclosed fact raises questions worth asking about your organization’s data exchanges, including the ones vendors run.

The target was a file transfer site

File transfer systems collect data from many sources, often in bulk and in formats that are easy to use. That makes them attractive targets, and attackers keep returning to them. The 2023 MOVEit campaign is the best known, but it isn’t the most recent. In December 2024, attackers exploited flaws in Cleo’s file transfer products, and the Cl0p ransomware group claimed responsibility. In October 2025, Microsoft reported that a ransomware affiliate had used a then-unknown flaw in GoAnywhere MFT to break into multiple organizations. Those campaigns exploited software vulnerabilities rather than stolen credentials, but they show why exchange points draw malicious attention.

Protecting your own starts with knowing where they are and what they hold:

• Can you list every file transfer site, shared folder, API integration, and scheduled data feed that carries sensitive data into or out of your organization, including those a vendor operates?

• Does data leave the exchange point once it’s delivered, or does it accumulate? A transfer site that keeps every file becomes an archive no one meant to build.

Access came through a login credential

Accounts used for data exchange are often different from everyday user logins. Some are shared. Some are service accounts created for an integration years ago and owned by someone who has since left. Automated processes can’t answer an MFA prompt, so these accounts often need other protections.

A few questions will show whether yours have them:

• Does every data exchange account have a named owner and a documented purpose, and when was it last reviewed?

• Where MFA can’t apply, are automated accounts protected in other ways, such as key-based authentication, restrictions on where they can connect from, access to only the folders their process needs, and regular credential rotation?

• Are vendor-operated exchange points held to the same standard? If a vendor issues your staff accounts on its transfer site, ask how those accounts are protected.

About four months passed before detection

We don’t know what monitoring was in place at ETS or why the activity wasn’t identified sooner. The general point stands on its own: monitoring on exchange systems is often built to confirm that data is moving, not to watch who is moving it. It will flag a scheduled transfer that fails. It may not notice who downloaded what, when, and how much.

Log retention matters too, because logs are how investigators reconstruct what happened. PowerSchool, a student information system vendor used by school districts across North America, offers an example. In December 2024, the company discovered that attackers had gotten in using compromised credentials, the same kind of entry point disclosed in the ETS incident. The privacy commissioner of Ontario, Canada, later found that earlier unauthorized activity had gone undetected in part because PowerSchool’s log retention was limited.

Check monitoring and retention in your own systems and in the ones vendors run for you:

• Are logs from file transfer systems collected centrally and kept long enough to investigate an incident that surfaces months later?

• Would you notice an exchange account downloading at an unusual hour, from an unusual location, or in unusual volume?

• For vendor-operated exchange points, do you know what the vendor monitors and how quickly it will tell you about unusual activity?

The files were copied

By CDE’s account, the files were accessed and copied. Theft that doesn’t disrupt operations is harder to notice than an attack that does. Nothing stops working, so nothing prompts anyone to look.

Two questions can help you gauge how long a copy might go unnoticed and how much it would expose:

• If data were copied from a vendor’s system today, how would you find out: through your own monitoring, the vendor’s notice, or a third party?

• Does each data feed carry only the fields the receiving process needs? The less a file contains, the less a copy exposes.

Questions that don’t wait for the findings

Once the ETS investigation is complete, its findings may point to causes this article hasn’t covered, but the questions above are worth asking either way. Every organization that exchanges sensitive data has accounts, transfer points, and logs that deserve the same attention as its core applications, whether the data is student records under FERPA, health information under HIPAA, or criminal justice information under CJIS.

The systems that move your data deserve as much scrutiny as the systems that store it.

Securance’s penetration testing and security assessments can include file transfer systems, integration accounts, and vendor connections — the exchange points that often fall between assessment scopes. Talk with our team about scoping your next assessment.