加州教育部门官员周五宣布，一家与该州教育部门签订合同的非营利组织遭到黑客攻击，导致数百万加州学生的个人信息被窃取。
Personal information about millions of California students was stolen in a hack of a non-profit organization that contracts with the state’s Department of Education, officials announced Friday.
加州教育部门（CDE）表示，过去三个学年在加州公立学校注册的全部700万学生的姓名、地址、人口统计信息以及残疾状况在此次泄露事件中被暴露。此次黑客攻击的目标是教育考试服务中心（ETS），该机构负责在美国及全球范围内实施标准化考试。在加州，它负责管理全州性评估，例如Smarter Balanced考试和英语水平测试。该公司未能立即回应置评请求。
The names, addresses, demographic information and disability status of all 7 million students enrolled in California public schools over the past three school years were exposed in the breach, the CDE said. The hack targeted the Education Testing Service, which administers standardized tests for across the U.S and globally. In California, it manages statewide assessments such as the Smarter Balanced exam and English proficiency tests. The company did not immediately respond to a request for comment.
根据CDE官员的说法，一名“未经授权的方使用了被泄露的凭证”在5月22日至9月18日期间复制了包含学生数据的文件。ETS直到9月25日才发现此次入侵，也就是事件结束后几天，随后州官员于周五开始通知学生和家长，CDE如是说。
An “unauthorized party used a compromised credential” to copy files containing the student data between May 22 and Sept. 18, according to CDE officials. ETS did not discover the incursion until Sept. 25, days after it ended, and state officials began notifying students and parents on Friday, according to the CDE.
在发现数据被窃取后，该公司将存储该数据的服务器下线，并禁用了被用于此次攻击的账户。官员表示，执法部门已获通知并正在进行调查。
After discovering data had been taken, the company took the server storing it offline and disabled the account used in the hack. Law enforcement has been notified and is conducting an investigation, officials said.
在安全漏洞发生后，ETS已暂停处理注册数据和“某些测试活动”，以评估其系统的安全性，这是根据教育部于10月2日发送给各学区的一封信所透露的，信中通知他们存在“涉及ETS运营系统的事件”。
In the wake of the breach, ETS has paused processing enrollment data and “certain testing activities while the security of its systems are assessed,” according to a letter the department sent to districts on Oct. 2 notifying them of an “incident involving ETS-operated systems.”
“我们理解加州学生和家庭的担忧，”加州教育部发言人在一份声明中表示。“保护学生信息是首要任务，我们期望承包商维持最高标准的数据安全和问责制。我们对此事件高度重视，正与州网络安全专家合作，并审查ETS是否符合其数据安全义务。我们的重点是确保受影响的学生和家庭获得所需的信息和资源，同时让承包商对保护学生数据负责。”
“We share the concerns of California students and families,” a CDE spokesperson said in a statement. “Protecting student information is a top priority, and we expect our contractors to uphold the highest standards of data security and accountability. We are taking this incident extremely seriously, working with state cybersecurity experts, and reviewing ETS’s compliance with its data security obligations. Our focus is on ensuring affected students and families receive the information and resources they need while holding our contractors accountable for protecting student data.”
官员表示，被窃取的信息不包括社会安全号码、驾驶执照、护照或金融账户信息。家长和监护人的数据也未受到影响。
The pilfered information did not include social security numbers, driver’s licenses, passports or financial account information, according to officials. Parents and guardians’ data was also not affected.
州官员表示，他们正“与州网络安全专家合作，评估对加州学生和家庭的影响，以便受影响的个人获得适当的信息和支持。”ETS也在为受影响的学生提供两年的身份盗窃防护服务访问权。
State officials said they are “working with state cybersecurity experts to assess the effect on California students and families and so that affected individuals receive appropriate information and support.”ETS is also offering affected students access to an identity-theft protection service for two years.
周五的公告是在今年春季另一次备受关注的黑客攻击之后发布的，该攻击导致Canvas学习模块系统瘫痪，Canvas是K-12学校、学院和大学常用的系统，用于布置作业、进行测试和与学生共享课程计划。在那起事件中，Canvas母公司Instructure的领导层选择与名为ShinyHunters的黑客团体达成协议，以追回被盗数据。
Friday’s announcement comes after another high-profile hack this spring shut down Canvas, a learning module system commonly used by K-12 schools, colleges and universities to assign homework, administer tests and share lesson plans with students. In that case, leaders of Canvas parent company Instructure opted to reach an agreement with the hacking group, known as ShinyHunters, to reclaim stolen data.
此次攻击发生在特朗普政府正因联邦机构持续遭受网络攻击而陷入困境之际——其中一次攻击直接与Canvas攻击相关联。
The attack took place as the Trump administration is reeling from an ongoing spree of cyberattacks on federal agencies — one of which was directly linked to the Canvas attack.
ShinyHunters 组织上个月声称对通过入侵 FBI 在线招聘门户窃取“几乎所有”FBI 人员的个人信息负责。该网络犯罪团伙在网上表示，此次黑客攻击是为了报复 FBI 在 Canvas 攻击事件后发布的一则公共服务公告，该公告详细说明了 ShinyHunters 的战术和技术。
ShinyHunters claimed responsibility last month for stealing the personal information of “almost all” FBI personnel after breaching the FBI’s online jobs portal. The cybercriminal group wrote online that the hack was carried out to retaliate against an FBI public service announcement detailing tactics and techniques of ShinyHunters, released following the attack on Canvas.
但随着 FBI 继续调查此事，其他机构也正遭到不同黑客的袭击。POLITICO 本周首次报道称，交通部下属的一家安全机构联络中心遭遇网络攻击，而美国法院行政办公室周四宣布，用于向联邦法院报告和传输破产通知的政府网站遭到另一次网络攻击而中断。此外，五角大楼仍在应对其人员记录组织被入侵的事件，该事件导致数百万人的个人数据泄露。
But as the FBI continues to investigate the incident, other agencies are being hit by separate hackers. POLITICO first reported this week that a Department of Transportation safety agency contact center was hit by a cyberattack, while the Administrative Office of the U.S. Courts announced Thursday that government websites used to report and transmit bankruptcy notices to federal courts were disrupted by a separate cyberattack. Additionally, the Pentagon is still responding to a breach of its personnel records organization, which exposed data on millions of individuals.