California Student Data Leaked

Commenters focused on the Reuters report that Educational Testing Service had unauthorized access to student records on an ETS-operated SFTP site. One commenter wanted technical clarity on why an SFTP server was used, how it was compromised, and what "building an entirely new SFTP site" actually entails, framing those questions as legitimate white-hat concerns. Others noted the announcement that the California Department of Education is distributing breach notices and that ETS took the site offline and implemented enhanced controls, but the primary thread of discussion remained on the mechanics and sufficiency of the remediation.

Opinion split between calls for harsh accountability and calls for systemic fixes. One commenter argued breaches like this should be company-ending, and another agreed, calling three years’ worth of leaked student data a severe FERPA violation. A different commenter pushed the conversation toward prevention, pointing out contractors frequently cause breaches (including in defense) and asking how to enforce data-security standards in contracts and in practice, admitting enforcement feels "above my pay grade" but necessary. The divide is therefore between punitive responses and broader questions about contract-level security governance and technical transparency.