Connecticut, New York, California Settle for $5.1M in Student Privacy Case
Illuminate Education failed to use basic security measures to protect student data, which led to a breach affecting millions of children, attorneys general from Connecticut, New York and California announced Thursday in a $5.1 million settlement with the education software company.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Connecticut said it's the first settlement reached under the state’s Student Data Privacy Law. AG William Tong (D) noted that the law requires “online educational providers to maintain data security measures that meet or exceed industry standards and that are designed to protect student data from unauthorized access or disclosure.”
Illuminate Education provides schools with software that tracks attendance, grades and academic behavior. The AGs alleged that in December 2021, hackers used credentials from a former Illuminate employee to access online accounts, including unencrypted personal data from millions of students.
According to Thursday's announcement, the breach affected 3 million students in California, 1.7 million in New York and nearly 30,000 in Connecticut. The company has agreed to pay $3.3 million to California, $1.7 million to New York and $150,000 to Connecticut. Illuminate didn’t immediately comment.