Over $5M penalty imposed on Illuminate Education for 2021 breach

U.S. educational technology firm Illuminate Education has been ordered to pay a $5.1 million fine to resolve alleged security failings following a data breach four years ago that compromised information from students across 49 states, reports The Record, a news site by cybersecurity firm Recorded Future.

Aside from not deleting former employees' login credentials, which have been purportedly leveraged to access its network, Illuminate also purportedly failed to track suspicious activity within its network, according to a statement from California Attorney General Rob Bonta, who filed the action alongside New York Attorney General Letitia James and Connecticut Attorney General William Tong.

Illuminate was also alleged to have had joint active and backup databases, while making false claims regarding its security practices to its users. Illuminate has not only agreed to pay the penalty but also committed to strengthening its access control and account management practices, while separating backup databases and conducting real-time network monitoring.