A September data breach at Educational Testing Service (ETS), California's statewide assessment contractor, that affected millions of current and former California public-school students has renewed calls for stronger cybersecurity across K-12. ETS found an unauthorised party had used a compromised login credential to access and copy student information over several months; the exposed records included names, birth dates, addresses, assessment information and certain disability-related data, according to the California Department of Education. ETS now faces a proposed class-action alleging inadequate safeguards, and the department is reviewing its compliance with contractual and data-security requirements. TJ Sayers of the Center for Internet Security pushed back on treating mega-breaches as inevitable, and Doug Levin of the K12 Security Information Exchange estimated roughly 80% of education-sector incidents could be prevented with basic security practices — the residue being sophisticated attacks or newly discovered flaws. Experts argue stronger vendor accountability and dedicated funding are the missing controls.

• Source article