ETS data breach: one stolen SFTP login exposed student records

How did one compromised login give an intruder nearly four months inside the SFTP server where California swapped student test data with Educational Testing Service (ETS)? The files held names, test results, disability status, Section 504 status and records on students who left as far back as 2006. The hosts split on blame: ETS for the dwell time, or the state for pooling every child's record at one vendor behind one login. You walk away able to audit your own vendor file drops: name an owner, check whether MFA is on, enforce data minimisation with a scheduled deletion job, and treat contract clauses as no substitute for controls that block a bulk download at midnight. 0:00 ETS breach via stolen SFTP login 1:29 Disability and Section 504 records exposed 2:33 Records since 2006 and data minimisation 4:03 Blame debate: ETS or state design 6:12 Notification delays, lawsuits and fallout 7:26 Unowned file drops and missing MFA