Loading story…
Illuminate Education, a California-based technology firm specializing in student data management, has agreed to pay $5.1 million in fines following enforcement actions by attorneys general in California, New York, and Connecticut. The penalties stem from a late 2021 hacking incident that compromised the personal and medical information of over 3 million students, including sensitive data such as names, race, special education status, and coded medical conditions. The largest portion of the settlement, $3.25 million, will go to California, with $1.7 million allocated to New York and $150,000 to Connecticut, reflecting the number of affected students in each state.
In addition to the financial penalties, Illuminate Education is required to implement and regularly update a comprehensive information security program. This program must include specific safeguards and controls designed to prevent future breaches and protect student data. The enforcement actions highlight the significant regulatory consequences for organizations that fail to adequately secure sensitive educational and healthcare information, particularly when serving vulnerable populations such as children with disabilities and special needs.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
A group of U.S. states imposed a $5.1 million penalty on a firm in connection with a cyberattack that affected 3 million students. The two references describe the same enforcement action and do not provide additional distinct events.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Illuminate Education, an educational technology company, has agreed to pay a $5.1 million fine and implement significant security reforms after a 2021 data breach exposed sensitive student information across 49 states, including three million students in California. The breach was attributed to multiple security failures, such as not deleting former employee credentials, inadequate monitoring for suspicious activity, and storing backup and active databases together, which allowed attackers to compromise both. The exposed data included student names, races, coded medical conditions, and special education accommodations. The settlement, announced by the attorneys general of California, Connecticut, and New York, also requires Illuminate to strengthen its access controls, improve account management, and enhance real-time monitoring. The incident has raised broader concerns about data privacy and security practices in the edtech sector, as highlighted by school administrators struggling to confirm data deletion after ending contracts with vendors. The case underscores the risks posed by insufficient offboarding processes and the importance of robust vendor management to protect student and parent information. Illuminate was also accused of making misleading statements in its privacy policy regarding compliance with federal and state laws, further intensifying scrutiny of edtech companies' data protection commitments.
Jun 29, 2026
The Federal Trade Commission (FTC) has taken enforcement action against *Illuminate Education*, an educational technology provider, following a significant data breach in December 2021 that exposed the personal information of over 10 million students. The breach occurred when a hacker exploited credentials belonging to a former employee who had left the company more than three years prior, gaining access to sensitive data such as email addresses, dates of birth, student records, and health information stored in cloud-based databases. The FTC alleged that Illuminate misrepresented its security practices to customers and school districts, including false claims about data encryption and inadequate access controls, threat detection, and vulnerability management. As part of the settlement, Illuminate Education is required to implement a comprehensive data security program and delete unnecessary data. The company had previously settled with three state attorneys general for $5.1 million and agreed to a corrective action plan. The FTC emphasized that companies handling children's data will be held accountable for failing to uphold privacy and security commitments, especially when sensitive information like medical diagnoses is involved. Illuminate was also criticized for storing student data in plain text and for delayed notification to affected school districts about the breach.
Jul 12, 2026
The U.S. Federal Trade Commission finalized an order against K-12 software vendor **Illuminate Education** after a December 2021 cyberattack exposed personal data belonging to about **10.1 million** current and former students. The agency said an attacker used credentials tied to a former employee to access records containing contact information, dates of birth, student records, and health-related data affecting school districts across multiple states. The FTC alleged Illuminate ignored security warnings dating back to 2020 and failed to maintain reasonable safeguards, including adequate access controls, threat detection, vulnerability monitoring, and patch management. The order imposes corrective measures rather than a financial penalty, requiring a comprehensive security program, data minimization and deletion of unnecessary personal information, a public data retention schedule, and restrictions on misrepresenting privacy, security, or breach-notification practices; the agency also said some districts were notified as much as two years late and now requires Illuminate to report future qualifying breaches to the FTC when other government agencies are notified.
Jun 29, 2026