According to the National Law Review, the Federal Trade Commission has approved a proposed settlement with Illuminate Education requiring the company to strengthen its data security practices following a breach that exposed the personal information of more than 10 million students.
The FTC alleges that Illuminate failed to implement reasonable safeguards to protect student data stored in cloud-based databases, allowing a hacker to access sensitive information in late December 2021 using the credentials of a former employee. The compromised data included students’ email and mailing addresses, dates of birth, student records, and health information.
According to the complaint, Illuminate also failed to notify school districts in a timely manner after discovering the breach. The FTC said the company waited nearly two years to inform some districts representing more than 380,000 students that their data had been accessed.
Under the proposed order, Illuminate is required to delete personal information that is no longer necessary to provide services, follow a publicly available data-retention schedule, and establish a comprehensive information security program designed to protect the confidentiality, integrity, and availability of personal data. The order also requires the company to notify the FTC if it reports a data breach to another federal, state, or local government entity.
The settlement does not include any monetary penalties. The FTC voted 2–0 to approve the proposed complaint and order for public comment.
The action underscores the FTC’s continued focus on data security in the education technology sector, particularly where companies handle sensitive student information. Regulators emphasized that organizations collecting and storing personal data must implement appropriate safeguards and respond promptly when breaches occur.