Quick question. Where does your students’ data go after it leaves your building?
Not the gradebook. The other stuff. The files that get exported, uploaded, synced, and shipped off to a vendor so someone can score, process, or report on them. Where does it sit after that? Who can log in to it? And when does it finally get deleted?
If you’re not sure, you’re in good company. Most districts can't answer that off the top of their head. But a breach reported this week in California makes it a question worth answering soon.
The Educational Testing Service (ETS) is a nonprofit that runs state and federally required testing for California under a contract with the state, and it used a secure file transfer site to move testing data back and forth with the California Department of Education. Think of that file transfer site as a shared drop box for big, sensitive files. see: securityweek
Someone used a compromised login to get into that site at various times between May 22 and September 18, 2026, and copied files of California student information. ETS didn’t spot the unauthorized activity until September 25.
That’s almost four months. With one working password.
And the scope is big. The state hasn’t released a victim count, but the data includes all students enrolled in the previous three school years. California had more than 5.7 million public school students in 2025-26 alone, and the affected group also includes students who left a California school as far back as 2006 whose transfer to another school was never confirmed. see: securityweek
Here’s what was in those files. Names, birth dates, home addresses, school and grade, state and local ID numbers, race or ethnicity, and English learner status. Some records went further: disability and Section 504 status, testing accommodations, test results, and whether a student was flagged for Title I, McKinney-Vento, or military-connected status. No Social Security numbers or financial information were involved, and parent data wasn’t exposed.
Honestly? That last list is the part that stuck with me. Disability status. Homelessness status. That’s not the kind of thing a family expects to read about in a breach notice.
First: your data can be exposed without anyone touching your network.
Nobody broke into a California school district. The data was taken from a vendor’s system, through a vendor’s account. The official notices don’t say how that login was stolen, and they don’t name the attacker. But it doesn’t really matter how it happened. One valid username and password was enough, and it stayed valid for months. see: securityweek
Your firewall, your filtering, your MFA rollout... all of that protects your systems. It does nothing for the copy of your data sitting on someone else’s server.
Second: data you don’t need anymore is still data you can lose.
Those 2006 records are the part I keep coming back to. Some of those students left California schools nearly twenty years ago. Their information was still sitting around, still exposed, because nobody had a reason to clean it out.
That’s not a California problem. That’s an everyone problem. Old rosters, old exports, old vendor accounts from a product you dropped three years ago. If it still exists, it can still leak.
Let’s be fair here. In California, this was a state contract. Districts didn’t pick ETS or sign that agreement. Statewide assessment contracts in Montana run through the state too, so you won’t be renegotiating those.
But plenty of student data moves under your own name. Interim assessments, rostering syncs, SIS exports, learning apps, special education platforms. Those vendor relationships are yours.
And Montana gives you some real tools. The Montana Pupil Online Personal Information Protection Act, passed in 2019, requires operators of K-12 online applications to delete a pupil’s protected information when the school or district requests it. The Montana Data Privacy Agreement was built to help districts comply with that law, and it’s available through the Montana School Boards Association. Test results and special education data are both listed as protected information under that agreement. see: Montana HB0745 +2
So the law is on your side. The question is whether anyone’s using it.
First: make a list of where student data leaves your building. Every file upload, every automated sync, every nightly export. You can’t protect a data flow you don’t know exists. It doesn’t need to be fancy. A spreadsheet with the vendor, what data goes, how it gets there, and who on your staff owns it is a great start.
Second: ask each vendor four plain questions. Who has login access to our data? Do those accounts require MFA? How long do you keep our records, and how do you delete them? And if something goes wrong, who tells us and how fast? If a vendor can’t answer those clearly, that tells you something.
Third: use your deletion rights. If you dropped a product, ask that vendor to delete your students’ data. In writing. Then ask them to confirm it’s done.
Fourth: check your own side of the fence. File transfer accounts get shared. Staff leave. Passwords live in an old email someone forwarded in 2019. Make sure the logins your district uses to send data out are retired when people move on, and protected with MFA where the vendor supports it.
And for the statewide stuff you don’t control? It’s completely reasonable to ask OPI how assessment vendors handle access and retention. You’re allowed to ask.
The goal isn’t to scare anyone. It’s to make sure that when the next breach notice lands, it isn’t about your kids.
As always, you can call or email with any questions.