FTC Orders 10 Years of Security Audits After Illuminate Education's Breach of 10.1 Million Students' Data

Illuminate Education, Inc., a California-registered company whose cloud-based K-12 software has been used to manage information for more than 17 million students across over 5,200 U.S. school districts, suffered a data breach between late December 2021 and January 2022.
According to the U.S. Federal Trade Commission's complaint, a threat actor used a former employee's credentials to access Illuminate's cloud hosting environment and exfiltrated data — including students' email and mailing addresses, dates of birth, academic records and health-related information — undetected for about 13 days. The breach affected more than 10.1 million current and former students.
The FTC alleged Illuminate had ignored prior warnings about security vulnerabilities, failed to implement reasonable safeguards such as encryption, access controls and monitoring, misrepresented its data-protection practices in public statements and school-district contracts, and did not provide timely breach notifications.
The Commission's final consent order, issued 5 June 2026 after a public comment period, requires Illuminate to publish a data-retention schedule within 90 days, adopt data-minimisation practices, and undergo independent third-party security assessments at the outset and then every two years for ten years — one of the FTC's longest-running education-sector data-security orders to date.
This case is included as a cautionary example of governance failure: it shows the consequences of inadequate data protection in widely deployed education software and the kind of long-horizon regulatory remedy now being applied to the sector.

Read the full analysis: https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3105-illuminate-education-inc-matter