Illuminate Education and Inc.: FTC Reaches Settlement with Ed Tech Provider Over Breach of Student Data

FTC Reaches Settlement with Ed Tech Provider Over Breach of Student Data

On December 1, 2025, the Federal Trade Commission (“FTC”) announced a proposed settlement with Illuminate Education, Inc. (“Illuminate”), an education technology provider, to resolve allegations that the company’s data security failures led to a data breach affecting the personal information of over 10 million students. The FTC’s enforcement action follows a recent $5.1 million multistate attorney general settlement with the company over the same breach.

The FTC’s complaint alleges that in December 2021, a hacker used the credentials of a former employee to gain unauthorized access to Illuminate’s cloud environment. According to the FTC, the breach affected the personal information of 10 million students, including email and mailing address, date of birth, student records, and health-related information.

The FTC alleges that despite Illuminate’s representations that it safeguards student data, the company failed to implement reasonable security measures. The FTC’s complaint notes that Illuminate stored student data in plain text until at least January 2022 and ignored warnings from a third-party vendor about security vulnerabilities. The FTC also alleges that the company failed to implement reasonable access controls, effective threat detection measures, and vulnerability monitoring and patch management practices. The FTC further alleges that Illuminate delayed notifying its customers of the breach, w

Source: https://www.hunton.com/privacy-and-information-security-law/ftc-reaches-settlement-with-ed-tech-provider-over-breach-of-student-data

Illuminate Education, Inc. TPRM report: https://www.rankiteo.com/company/illuminate-education-inc.

"id": "ill1765175583",
"linkid": "illuminate-education-inc.",
"type": "Breach",
"date": "12/2021",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Over 10 million students',
                        'industry': 'EdTech',
                        'name': 'Illuminate Education, Inc.',
                        'type': 'Education Technology Provider'}],
 'attack_vector': 'Compromised Credentials',
 'customer_advisories': 'Delayed notifications',
 'data_breach': {'data_encryption': 'No (stored in plain text until at least '
                                    'January 2022)',
                 'number_of_records_exposed': '10 million',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Email address',
                                              'Mailing address',
                                              'Date of birth',
                                              'Student records',
                                              'Health-related information']},
 'date_detected': '2021-12',
 'date_publicly_disclosed': '2025-12-01',
 'description': 'The Federal Trade Commission (FTC) announced a proposed '
                'settlement with Illuminate Education, Inc. (Illuminate) to '
                'resolve allegations that the company’s data security failures '
                'led to a data breach affecting the personal information of '
                'over 10 million students. The breach involved unauthorized '
                'access to Illuminate’s cloud environment using credentials of '
                'a former employee, exposing sensitive student data.',
 'impact': {'brand_reputation_impact': 'Yes',
            'data_compromised': 'Personal information of over 10 million '
                                'students',
            'financial_loss': '$5.1 million (multistate attorney general '
                              'settlement)',
            'identity_theft_risk': 'Yes',
            'legal_liabilities': 'FTC settlement, multistate attorney general '
                                 'settlement',
            'systems_affected': 'Cloud environment'},
 'initial_access_broker': {'entry_point': 'Compromised credentials of a former '
                                          'employee'},
 'investigation_status': 'Settled',
 'post_incident_analysis': {'root_causes': ['Lack of access controls',
                                            'Plain text data storage',
                                            'Ignored security warnings',
                                            'Poor vulnerability monitoring and '
                                            'patch management']},
 'references': [{'date_accessed': '2025-12-01',
                 'source': 'Federal Trade Commission'}],
 'regulatory_compliance': {'fines_imposed': '$5.1 million (multistate attorney '
                                            'general settlement)',
                           'legal_actions': ['FTC settlement',
                                             'Multistate attorney general '
                                             'settlement']},
 'response': {'communication_strategy': 'Delayed customer notifications'},
 'threat_actor': 'Unknown Hacker',
 'title': 'FTC Reaches Settlement with Ed Tech Provider Over Breach of Student '
          'Data',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Lack of access controls, plain text data storage, '
                            'unpatched vulnerabilities'}