California Attorney General Rob Bonta, Connecticut Attorney General William Tong, and New York Attorney General Letitia James today announced that they have secured $5.1 million and injunctive terms from educational technology company Illuminate Education, Inc. (Illuminate) for failing to protect students’ data. In 2021, Illuminate experienced a data breach that exposed the information of millions of students, including California students across 49 school districts. The breached data included sensitive personal and medical information, such as student name, race, whether the student received special education services or reasonable accommodations, and coded medical conditions. Of the three million California students impacted by the breach, more than 434,000 had sensitive information stolen. As part of the three separate settlements with the states, Illuminate has agreed to pay California $3.25 million in civil penalties and has agreed to comply with requirements to strengthen its data security practices.  
“Illuminate failed to appropriately safeguard the data of school children, resulting in a data breach that compromised the sensitive data of students nationwide, including more than 434,000 California students. Our investigation revealed a troubling pattern of security deficiencies that should have never happened for a company charged with protecting data about kids,” said Attorney General Rob Bonta. “Today’s settlement should send a clear message to tech companies, especially those in the education space: California law imposes heightened obligations for companies to secure children’s’ information. I am grateful to Attorney General James and Attorney General Tong for their partnership in investigating companies that fail to safeguard our residents’ data. Data security concerns know no borders, and as today’s settlements showcase, neither should state collaboration.”