An educational software provider has agreed to pay $5.1 million after exposing the personal data of millions of students, including 1.7 million in New York alone.
The settlement follows a multistate investigation into Illuminate Education, Inc., a company that supplies software used by schools to monitor students’ grades, attendance, and even mental health.
The breach occurred in 2022, when hackers accessed an Illuminate account using the login of a former employee who had left the company years earlier. Once inside, they downloaded unencrypted data that included names, birth dates, student ID numbers, and other sensitive demographic information.
Investigators from New York, California, and Connecticut found that Illuminate failed to implement even basic data protections, including encryption and account monitoring. The company also failed to deactivate old user accounts and neglected to delete student data after contracts ended.
The enforcement action was led by Attorneys General from New York, California, and Connecticut, who say the breach is a warning to all ed-tech firms.
In addition to the financial penalty, Illuminate must now:
- Maintain a robust information security program
- Encrypt all student data it collects and stores
- Monitor for suspicious activity
- Limit who has access to student records
- Allow schools to identify and request deletion of outdated or inactive data
New York will receive $1.7 million from the settlement.
The investigation was conducted in collaboration with the New York State Education Department (NYSED), which said the breach was a “serious violation of trust.” Investigators noted that the company misrepresented its security practices, which failed to match the promises made to schools and families.
“Administrators, caregivers, and students should feel confident that the software platforms used in schools uphold the highest standards of data security and privacy,” said NYSED Commissioner Rosa.
FingerLakes1.com is the region’s leading all-digital news publication. The company was founded in 1998 and has been keeping residents informed for more than two decades. Have a lead? Send it to news@fingerlakes1.com.