Episode Details

How did one compromised login give an intruder nearly four months inside the SFTP server where California swapped student test data with Educational Testing Service (ETS)? The files held names, test results, disability status, Section 504 status and records on students who left as far back as 2006. The hosts split on blame: ETS for the dwell time, or the state for pooling every child's record at one vendor behind one login.

You walk away able to audit your own vendor file drops: name an owner, check whether MFA is on, enforce data minimisation with a scheduled deletion job, and treat contract clauses as no substitute for controls that block a bulk download at midnight.

Key takeaways

• Give every SFTP file drop that feeds a vendor a named owner, since folders often belong to someone who left long ago.
• Enforce data minimisation with a scheduled deletion job, not only a written policy.
• Do not pool every record at one vendor behind one login when the job does not need it.
• Treat a contract clause as a promise on paper and require controls that detect unusual bulk downloads.
• Check whether multifactor authentication is on for every file transfer account.

Chapters
0:00 ETS breach via stolen SFTP login
1:29 Disability and Section 504 records exposed
2:33 Records since 2006 and data minimisation
4:03 Blame debate: ETS or state design
6:12 Notification delays, lawsuits and fallout
7:26 Unowned file drops and missing MFA

Sources

• Hackers Steal Personal Data of Millions of California Students in Massive Breach
• Millions of California student records breached, some dating back to 2006
• ETS Sued Over Data Breach Affecting Current, Former Calif. Students
• One Compromised Login Exposed Millions of California Students' Records - SecurityWeek
• Cotchett, Pitre & McCarthy Files Class Action Lawsuit Against Educational Testing Service for Unlawfully Exposing Private Information of California Students

Full transcript: https://www.mba-training.com/en/podcast/data/ets-breach-student-data-retention

The article: https://www.mba-training.com/en/blog/ets-breach-student-data-retention

MBA Training, mba-training.com