FTC orders Illuminate Education to bolster data security after breach impacting 10M students

June 9, 2026 - 04:47

The Federal Trade Commission has ordered Illuminate Education to overhaul its data security practices following a breach that exposed the personal information of roughly 10 million students. The company, which provides assessment and data analytics tools for schools, must also stop misrepresenting how it protects user privacy.

According to the FTC, Illuminate failed to implement basic safeguards, such as encrypting student data and limiting access to sensitive files. The breach, which occurred in 2022, allowed attackers to access names, birth dates, and academic records. In some cases, disability status and other confidential details were also compromised.

The agency's order requires Illuminate to develop a comprehensive security program, undergo independent audits every two years, and notify affected schools and families about the incident. The company is also banned from making false claims about its data handling practices.

This case highlights ongoing concerns about the security of student data in the edtech sector. Schools often rely on third-party vendors for digital tools, but oversight of those vendors' security measures has been inconsistent. The FTC's action signals a push to hold companies accountable when they fail to protect children's information.

Illuminate Education did not immediately comment on the order. The company continues to serve thousands of school districts across the United States.