Court Rules
All enforcement actions
SettlementHigh RiskMultistate

Multistate AGs Secure $5.1M from Illuminate Education for Student Data Breach

Illuminate Education, Inc.November 6, 2025New York Attorney General

Penalty Amount

$5,100,000

Summary

New York, California, and Connecticut attorneys general reached a $5.1 million settlement with educational technology company Illuminate Education, Inc. for failing to protect student data, resulting in a 2022 breach exposing millions of students’ personal information. The investigation found Illuminate failed to implement basic security measures including data encryption, suspicious activity monitoring, and proper decommissioning of inactive user accounts, and did not delete student data when required by contracts. Illuminate must pay the penalty and implement enhanced data security measures including a comprehensive information security program, encryption of student data, and annual notice to schools about data collection and deletion options.

Remedy

Illuminate must pay $5.1 million in penalties and costs, with New York receiving $1.7 million. The company is required to implement a comprehensive information security program including data encryption, access limitations, network monitoring for suspicious activity, and a vulnerability management program. Illuminate must also provide annual notices to schools identifying collected student data categories and allow schools to request deletion of dated or inactive student records.

Monetary PenaltyCompliance ProgramData Deletion

Contract Impact

In-house legal teams should review all edtech and student data vendor agreements to ensure they include mandatory data encryption requirements, provisions for decommissioning inactive user accounts, and obligations to monitor for suspicious network activity. Contracts should also specify student data retention and deletion timelines, require vendors to maintain comprehensive information security programs, and mandate vulnerability management processes. Additionally, agreements should require vendors to provide annual notices detailing collected student data categories and allow the institution to request deletion of inactive or outdated student records. Teams should also verify that vendors do not misrepresent their data security practices and are compliant with applicable state student data privacy laws.

Contract Search Terms

student data security requirementsdata encryption obligationsinactive user account decommissioningstudent data deletion clausevulnerability management programsuspicious activity monitoringstudent data retention policyedtech vendor compliance

Laws Cited

Connecticut Student Data Privacy LawCalifornia student data privacy lawsNew York student data privacy laws

Violation Types

Entity Details

Entity

Illuminate Education, Inc.

Also known as: Illuminate Education

Industry

Technology

Multistate Coalition

Official Sources

Source Evidence

Entity Name
"educational technology company Illuminate Education, Inc. (Illuminate)"
Fine Amount
"secured $5.1 million from educational technology company Illuminate Education, Inc. (Illuminate)"
Event Date
"November 6, 2025"
Laws Cited
"Connecticut’s Student Data Privacy Law requires strict security to protect children’s information"
Laws Cited
"California law imposes heightened obligations for companies to secure children’s’ information"
Violation Types
"In 2022, Illuminate experienced a data breach that exposed the personal information of millions of students"

Related Enforcement Actions

FTC

Illuminate Education, Inc.

The FTC proposed a consent order against Illuminate Education, Inc. for failing to secure student data, leading to a breach affecting over 10 million students. The company allegedly had security failures and delayed breach notifications. The order requires a data security program, data deletion, and a retention schedule.

CT

Illuminate Education, Inc.

$5.1M

Connecticut Attorney General William Tong, along with California and New York Attorneys General, settled with Illuminate Education, Inc. for failing to protect student data in a breach that exposed personal information of millions of students. The settlement, the first under Connecticut's Student Data Privacy Law, requires Illuminate to pay $5.1 million and implement enhanced cybersecurity measures.

CA

Illuminate Education, Inc.

$5.1M

California Attorney General Rob Bonta, joined by Connecticut and New York Attorneys General, secured a $5.1 million multistate settlement with edtech company Illuminate Education, Inc. over a 2021 data breach that exposed sensitive personal and medical information of millions of students, including over 434,000 California students. The investigation found Illuminate failed to implement basic security measures, including failing to terminate former employee credentials, lacking suspicious activity monitoring, and unsecured backup databases, as well as making false statements in its privacy policy. Illuminate must pay $3.25 million to California, implement enhanced security practices, and notify the CA DOJ of future student data breaches.

NY

N/A

New York Attorney General Letitia James issued a consumer alert on May 18, 2026, warning residents of potential price gouging by transportation service providers during the Long Island Rail Road strike. The alert reminds businesses that New York’s price gouging laws prohibit unconscionable price increases on essential services like transportation during market disruptions. No specific privacy violations or enforcement actions against individual entities were announced in the alert.

NY

No specific entity cited

New York Attorney General Letitia James issued a consumer alert on May 18, 2026, warning businesses against engaging in price gouging on transportation services during the Long Island Rail Road strike. The alert reminds businesses that New York’s price gouging laws prohibit unconscionable price increases on essential goods and services during market disruptions, with potential penalties of up to $25,000 per violation. No specific enforcement action against a particular entity was announced, only a general warning for businesses and a call for consumers to report suspected price gouging.

NY

N/A

This press release announces New York Attorney General Letitia James leading a coalition of 21 state attorneys general, the District of Columbia, and Pennsylvania’s Governor in filing an amicus brief with the U.S. Supreme Court to stay a Fifth Circuit ruling that would reinstate in-person dispensing requirements for mifepristone, a medication used for abortion. The coalition argues the ruling is scientifically unsupported, would restrict telehealth access to reproductive care, and undermines state sovereignty over abortion policy post-Dobbs. This is not a privacy-related enforcement action, as the content addresses reproductive health policy rather than data privacy violations.