Central Intelligence
Central IntelligencePERSPECTIVE IS EVERYTHING
Last Update: 08/01/2026 at 1:00 PM EST

FTC Orders Illuminate Over Student Breach

Coverage from Govtech, Federal Trade Commission, and others

Articles

5

Active Days

14

The Topic

FTC Orders Illuminate Over Student Breach topic image

The Federal Trade Commission finalized an order requiring K-12 software provider Illuminate Education to strengthen security controls after an alleged breach exposed personal information associated with more than 10.1 million current and former students. The order restricts unnecessary data collection and retention, requires deletion and retention disclosures, prohibits misleading security or breach-notification claims, and imposes recurring independent assessments and reporting. The action highlights increasing regulatory scrutiny of how education technology vendors secure, retain, and communicate about sensitive student data.

First Article: 06/05/26

Latest Article: 06/18/26

Summary

  • The FTC finalized a modified order against Illuminate Education on June 5, 2026.
  • The agency alleged that a 2021–2022 intrusion exposed data linked to more than 10.1 million students.
  • Alleged weaknesses included inadequate access controls, monitoring, vulnerability management, patching, and cloud-database security.
  • The order requires data minimization, deletion of unnecessary information within 90 days, and publication of a retention schedule.
  • Illuminate must maintain a comprehensive information security program and undergo independent assessments initially and every two years for 10 years.
  • The order bars misrepresentations about security practices and breach-notification timing and requires reporting of additional reportable incidents.

History

07/21/2026

The main update is that the FTC order now appears more operational and long-term, adding recurring independent assessments and incident reporting requirements on top of the existing security, retention, and disclosure limits. The story also sharpens the alleged breach timeline and the specific control failures the agency says contributed to it.

Featured

06-09-2026
Govtech
FTC Orders Illuminate to Improve Security, Limit Data Retention
The FTC finalized an order against Illuminate Education Inc. in 2025 requiring stronger student data security and retention limits after a 2021-2022 breach involving 10.1 million students.
06-05-2026
Federal Trade Commission
FTC Gives Final Approval to Order Against Illuminate Settling Allegations It Failed to Secure Students’ Personal Data
Federal Trade Commission finalized a modified order against Illuminate Education Inc. after a student-data breach exposed 10.1 million students, requiring stronger security, retention limits, and breach-notification commitments.
06-08-2026
StateScoop
FTC Orders Illuminate Education to Bolster Data Security After Breach Impacting 10M Students
The FTC finalized an order against Illuminate Education in the 2020s, requiring data-security upgrades and data minimization after a 2021 student-data breach affected New York City and other districts.

Timeline: 14 Days

Jun 5Jun 8Jun 10Jun 13Jun 15Jun 18

Additional Articles

⭐⭐⭐⭐⭐

Alston & Bird Privacy / Maki DePalo06-18-2026
FTC Targets EdTech Data Practices in Final Order Following Major Student Data Breach
FTC finalized a modified consent order on June 5, 2026 against Illuminate Education for a student-data breach involving about 10.1 million records and insufficient data security and notice practices.

⭐⭐⭐

MLex06-05-2026
US FTC Gives Final Nod to Settlement With Illuminate Over Student Data
The US Federal Trade Commission finalized a modified order against Illuminate Education in response to alleged data security failures behind a major student data breach.