Loading story…
The U.S. Federal Trade Commission took action against alcohol delivery company Drizly and its CEO, James Cory Rellas, over security failures that exposed personal data belonging to about 2.5 million consumers. The agency said the company failed to implement basic safeguards, allowing an attacker to access a company GitHub account and use credentials stored there to reach Drizly's cloud environment, where customer information was compromised.
Under the proposed order, Drizly must destroy unnecessary personal data, limit future collection and retention, and establish a comprehensive information security program with outside assessments. The FTC also imposed obligations on Rellas that would follow him to future companies, requiring him to ensure any business he leads implements strong security controls if it collects personal information from more than 25,000 people.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
The U.S. Federal Trade Commission announced a proposed order against Drizly and its CEO James Cory Rellas over alleged security failures tied to the breach. The order included requirements to destroy unnecessary personal data, implement stronger security controls, and imposed obligations on Rellas for future companies he leads.
Drizly experienced a security incident that exposed the personal information of about 2.5 million consumers. The FTC later said the breach stemmed from security failures including inadequate access controls and poor data retention practices.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
archive.ph
Open sourceftc.gov
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Federal Trade Commission finalized an order against K-12 software vendor **Illuminate Education** after a December 2021 cyberattack exposed personal data belonging to about **10.1 million** current and former students. The agency said an attacker used credentials tied to a former employee to access records containing contact information, dates of birth, student records, and health-related data affecting school districts across multiple states. The FTC alleged Illuminate ignored security warnings dating back to 2020 and failed to maintain reasonable safeguards, including adequate access controls, threat detection, vulnerability monitoring, and patch management. The order imposes corrective measures rather than a financial penalty, requiring a comprehensive security program, data minimization and deletion of unnecessary personal information, a public data retention schedule, and restrictions on misrepresenting privacy, security, or breach-notification practices; the agency also said some districts were notified as much as two years late and now requires Illuminate to report future qualifying breaches to the FTC when other government agencies are notified.
Jun 29, 2026
The Federal Trade Commission (FTC) has taken enforcement action against *Illuminate Education*, an educational technology provider, following a significant data breach in December 2021 that exposed the personal information of over 10 million students. The breach occurred when a hacker exploited credentials belonging to a former employee who had left the company more than three years prior, gaining access to sensitive data such as email addresses, dates of birth, student records, and health information stored in cloud-based databases. The FTC alleged that Illuminate misrepresented its security practices to customers and school districts, including false claims about data encryption and inadequate access controls, threat detection, and vulnerability management. As part of the settlement, Illuminate Education is required to implement a comprehensive data security program and delete unnecessary data. The company had previously settled with three state attorneys general for $5.1 million and agreed to a corrective action plan. The FTC emphasized that companies handling children's data will be held accountable for failing to uphold privacy and security commitments, especially when sensitive information like medical diagnoses is involved. Illuminate was also criticized for storing student data in plain text and for delayed notification to affected school districts about the breach.
Jul 12, 2026
QualDerm Partners, a Tennessee-based healthcare management company that supports dermatology practices, disclosed a cyberattack that exposed the personal and protected health information of more than **3.1 million** individuals. The company said it detected unusual activity on December 24 and later determined that an unauthorized actor accessed a limited number of internal systems between December 23 and December 24, 2025, and exfiltrated stored data. The stolen information reportedly included names, dates of birth, medical record numbers, treatment and diagnosis details, health insurance information, and driver’s license numbers, making the incident one of the larger recent healthcare data breaches. QualDerm notified the U.S. Department of Health and Human Services Office for Civil Rights, informed law enforcement and regulators, and began offering affected individuals complimentary identity protection and credit monitoring; the company did not publicly attribute the intrusion, disclose the volume of data taken, or say whether a ransom demand was involved.
Jun 29, 2026