Breach-hit Illuminate Education reaches settlement with FTC

U.S. educational technology firm Illuminate Education will be adopting a data security program, as well as eliminating unnecessary data to resolve Federal Trade Commission allegations of dismal security measures in the lead up to a major breach four years ago that compromised 10.1 million students, according to The Record, a news site by cybersecurity firm Recorded Future.

According to the FTC, Illuminate's internal safeguards did not match the assurances it gave to school districts, leaving its systems vulnerable. The FTC also said the company failed to act on a January 2020 warning from a third-party vendor about weaknesses in its network and continued to store sensitive information in plain text through January 2022. Some school districts were not informed of the breach for nearly two years.

As part of the settlement, Illuminate has also pledged to accelerate breach notifications and promptly inform the FTC regarding incidents reported to other agencies and state and local governments.