Attorney General James and Multistate Coalition Secure $5.1 Million from Illuminate Education For Failing to Protect Students’ Data

In a joint action, Illuminate Education, Inc. has been ordered to pay $5.1 million after investigations found it failed to protect students’ data, including a 2022 breach that exposed the personal information of millions of students and 1.7 million New York students. According to Attorney General James, Illuminate had not implemented basic security measures, such as monitoring for suspicious activity, encrypting student data, or decommissioning inactive accounts.

The settlements require Illuminate to adopt stronger cybersecurity practices, including a comprehensive information security programme, data access controls, data encryption, system monitoring, and a vulnerability management programme. The case also notes that more than 434,000 California students were affected by the breach, underscoring the nationwide scope of the security failures.

New York will receive $1.7 million of the total penalties and costs, and Illuminate must provide annual notices to schools detailing the categories of data it collects and how deletions will be handled.