Penalty Amount
$5,100,000
New York, California, and Connecticut attorneys general reached a $5.1 million settlement with educational technology company Illuminate Education, Inc. for failing to protect student data, resulting in a 2022 breach exposing millions of students’ personal information. The investigation found Illuminate failed to implement basic security measures including data encryption, suspicious activity monitoring, and proper decommissioning of inactive user accounts, and did not delete student data when required by contracts. Illuminate must pay the penalty and implement enhanced data security measures including a comprehensive information security program, encryption of student data, and annual notice to schools about data collection and deletion options.
Illuminate must pay $5.1 million in penalties and costs, with New York receiving $1.7 million. The company is required to implement a comprehensive information security program including data encryption, access limitations, network monitoring for suspicious activity, and a vulnerability management program. Illuminate must also provide annual notices to schools identifying collected student data categories and allow schools to request deletion of dated or inactive student records.
In-house legal teams should review all edtech and student data vendor agreements to ensure they include mandatory data encryption requirements, provisions for decommissioning inactive user accounts, and obligations to monitor for suspicious network activity. Contracts should also specify student data retention and deletion timelines, require vendors to maintain comprehensive information security programs, and mandate vulnerability management processes. Additionally, agreements should require vendors to provide annual notices detailing collected student data categories and allow the institution to request deletion of inactive or outdated student records. Teams should also verify that vendors do not misrepresent their data security practices and are compliant with applicable state student data privacy laws.
Entity
Illuminate Education, Inc.
Also known as: Illuminate Education
Industry
TechnologyOfficial Press Release
https://ag.ny.gov/press-release/2025/attorney-general-james-and-multistate-coalition-secure-51-million-education
illuminate education inc assurance of discontinuance 2025
https://ag.ny.gov/sites/default/files/settlements-agreements/illuminate-education-inc-assurance-of-discontinuance-2025.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"educational technology company Illuminate Education, Inc. (Illuminate)"
"secured $5.1 million from educational technology company Illuminate Education, Inc. (Illuminate)"
"November 6, 2025"
"Connecticut’s Student Data Privacy Law requires strict security to protect children’s information"
"California law imposes heightened obligations for companies to secure children’s’ information"
"In 2022, Illuminate experienced a data breach that exposed the personal information of millions of students"
The FTC proposed a consent order against Illuminate Education, Inc. for failing to secure student data, leading to a breach affecting over 10 million students. The company allegedly had security failures and delayed breach notifications. The order requires a data security program, data deletion, and a retention schedule.
$5.1M
Connecticut Attorney General William Tong, along with California and New York Attorneys General, settled with Illuminate Education, Inc. for failing to protect student data in a breach that exposed personal information of millions of students. The settlement, the first under Connecticut's Student Data Privacy Law, requires Illuminate to pay $5.1 million and implement enhanced cybersecurity measures.
$5.1M
California Attorney General Rob Bonta, joined by Connecticut and New York Attorneys General, secured a $5.1 million multistate settlement with edtech company Illuminate Education, Inc. over a 2021 data breach that exposed sensitive personal and medical information of millions of students, including over 434,000 California students. The investigation found Illuminate failed to implement basic security measures, including failing to terminate former employee credentials, lacking suspicious activity monitoring, and unsecured backup databases, as well as making false statements in its privacy policy. Illuminate must pay $3.25 million to California, implement enhanced security practices, and notify the CA DOJ of future student data breaches.
$17.1B
Attorney General James and a bipartisan coalition of 50 other attorneys general secured a landmark settlement with Meta Platforms, Inc. (Meta) worth up to $17.1 billion to address the company's harmful and addictive features targeting minors on Facebook and Instagram. The settlement requires Meta to implement significant changes, including age verification, time limits for minors, restrictions on notifications, and options to opt out of algorithmic feeds, along with monetary payments to states for mental health and education programs.
$3.3M
New York Attorney General Letitia James announced a multistate settlement with Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch for illegally coordinating to influence a daily price index for eggs, artificially inflating prices for retailers and consumers nationwide. The companies will deliver 53 million eggs to food banks across 17 participating states, pay a combined $3.3 million, and adopt compliance measures to prevent future violations.
$2.0M
New York Attorney General Letitia James, along with four other states and the FTC, settled with Zillow and Redfin after they entered an illegal agreement to stop competing in the multifamily rental advertising market. Zillow paid Redfin $100 million to shut down its advertising business and exclusively display Zillow's listings. The settlement requires the companies to resume competing and pay $2 million.