FTC, State AGs Crack Down On Ed Tech Company After Massive Student Data Breach

FTC, State AGs Crack Down On Ed Tech Company After Massive Student Data Breach

Get stories like this delivered straight to your inbox.Sign up for The 74 Newsletter

Get و stories و like - تفاصيل مهمة

When the Federal Trade Commission announced this month it was taking action against technology company Illuminate Education over a massive 2021 data breach, it added to the list of government measures against the firm since hackers broke into its systems and made off with the sensitive information of than 10 million students.

Three state attorneys general have also now imposed penalties and security mandates on the company following allegations it misled customers about its cybersecurity safeguards and waited nearly two years to notify some school districts of the widespread data breach.

The ones that haven’t made progress in their efforts to hold Illuminate accountable are parents and students. Their pursuit hit a wall in September when the Ninth Circuit Court of Appeals dismissed a federal lawsuit filed by the breach victims. The court, ruling on a case filed in California, found that the theft of their personal data — including grades, special education information and medical records — didn’t constitute a concrete harm.

The federal appeals court affirmed a lower-court dismissal of a proposed class-action lawsuit filed by families whose children’s information was compromised. The court concluded the plaintiffs lacked standing because they did not demonstrate actual damage from the breach or an “imminent and substantial” risk of future identity theft. In the years since the cyberattack was carried out, the court concluded, there was no evidence that the records, which did not include Social Security numbers, had been misused to commit identity theft.

the و a و and - تفاصيل مهمة

“It has been than three years since the breach,” the court wrote, “and no fraud has occurred, nor is the kind of information at issue the kind that this court normally considers sufficient to find a credible threat of identity theft.”

Under a proposed settlement announced by the FTC this month, Illuminate will be required to create a “comprehensive information security program,” delete any student data it is no longer using and notify the commission of any future data breaches. Regulators allege a third-party company hired by Illuminate to assess its cybersecurity safeguards raised red flags but Illuminate failed to heed those warnings a year before it was hacked using the compromised credentials of a former employee.

a و Illuminate و the - تفاصيل مهمة

“Illuminate pledged to secure and protect personal information about children and failed to do so,” Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said in a media release this month. The FTC action, Mufarrige continued, should serve as a warning to other companies that the commission “will hold them accountable if they fail to keep their privacy promises to consumers, particularly when it involves children’s medical diagnoses and other personal data.”

After the data breach, which affected the country’s two largest school districts in New York City and Los Angeles among others, Illuminate was quietly acquired for an undisclosed amount by another education technology company, Renaissance Learning, in 2022. Since then, a Renaissance spokesperson said in a statement to The 74 this week, Illuminate products have been incorporated into its “cybersecurity and data protection program.”

Renaissance safeguards include “robust security protocols and controls used to safeguard the integrity and confidentiality of the data entrusted to us by schools, educators and families,” the spokesperson said.

The FTC action comes on the heels of an unprecedented multistate settlement last month, when state attorneys general in California, Connecticut and New York secured a combined $5.1 million in penalties from Illuminate, along with cybersecurity requirements that resemble the FTC’s demands. State investigators similarly alleged sweeping security flaws at the company, including the failure to monitor suspicious activity and deactivate the inactive user accounts of former employees.

the و and و in - تفاصيل مهمة

A California Department of Justice inquiry concluded that Illuminate made “false and misleading statements” about its cybersecurity safeguards in its privacy policy and “deceptively advertised” to school districts that it was a signatory of the nonprofit Future of Privacy Forum’s now-defunct “Student Privacy Pledge.”

The voluntary pledge, which was “retired” in Aprilsought to hold education technology companies accountable for maintaining “a comprehensive security program” to protect students’ personal information and to prevent the sale of student records for targeted advertising.

the و of و to - تفاصيل مهمة

Illuminate became the first ed tech company to get booted from the pledge after reporting by The 74 called into question its utility in holding tech firms accountable for failing to meet its provisions.

The multistate enforcement action was the first time Connecticut regulators reached a settlement under its state student data privacy law — which was enacted nearly a decade ago.

was و a و Related - تفاصيل مهمة

“Technology is everywhere in schools today, and Connecticut’s Student Data Privacy Law requires strict security to protect children’s information,” Connecticut Attorney General William Tong said in a statement. The settlement “holds Illuminate accountable and sends a strong message to education technology companies that they must take privacy obligations seriously.”

Sign-up for the School (in)Security newsletter.

Get the most critical news and information about students’ rights, safety and well-being delivered straight to your inbox.

the و and و Sign-up - تفاصيل مهمة

Did you use this article in your work?

We’d love to hear how The 74’s reporting is helping educators, researchers, and policymakers.Tell us how

how و و We’d - تفاصيل مهمة

Disclaimer: This news article has been republished exactly as it appeared on its original source, without any modification.
We do not take any responsibility for its content, which remains solely the responsibility of the original publisher.

Author:Mark Keierleber
Published on:2025-12-12 15:30:00
Source: www.the74million.org

Disclaimer: This news article has been republished exactly as it appeared on its original source, without any modification. We do not take any responsibility for its content, which remains solely the responsibility of the original publisher.

Author: uaetodaynews
Published on: 2025-12-15 07:31:00
Source: uaetodaynews.com