FTC Takes Action Against Education Technology Provider for Failing to Secure Students’ Personal Data

The Federal Trade Commission has taken action against Illuminate Education, Inc. over data security failures that led to a major breach affecting more than 10 million students, according to the FTC. The complaint alleges that Illuminate claimed to protect student data but failed to deploy reasonable security measures, with incidents including storing data in plain text and lacking adequate access controls, threat detection, and patch management.

It notes that in late December 2021 a hacker used a former employee’s credentials to access databases hosted by a third‑party cloud provider, exposing the personal information of 10.1 million students. The proposed order requires Illuminate to delete unnecessary data, implement a comprehensive information security programme, and improve breach notification practices, while prohibiting misrepresentations about its data security and privacy practices.

The action follows a separate state attorney general settlement against Illuminate for $5.1 million and a corrective action plan, and the FTC’s measure carries potential civil penalties of up to $51,744 per violation. The commission’s lead staff are Bhavna Changrani and Robin Rosen Spector.