Three state attorneys general have also now imposed penalties and security mandates on the company following allegations it misled customers about its cybersecurity safeguards and waited nearly two years to notify some school districts of the widespread data breach. 

The ones that haven’t made progress in their efforts to hold Illuminate accountable are parents and students. Their pursuit hit a wall in September when the Ninth Circuit Court of Appeals dismissed a federal lawsuit filed by the breach victims. The court, ruling on a case filed in California, found that the theft of their personal data — including grades, special education information and medical records — didn’t constitute a concrete harm.

The federal appeals court of a proposed class-action lawsuit filed by families whose children’s information was compromised. The court concluded the plaintiffs lacked standing because they did not demonstrate actual damage from the breach or an “imminent and substantial” risk of future identity theft. In the years since the cyberattack was carried out, the court concluded, there was no evidence that the records, which did not include Social Security numbers, had been misused to commit identity theft. 

“It has been more than three years since the breach,” the court wrote, “and no fraud has occurred, nor is the kind of information at issue the kind that this court normally considers sufficient to find a credible threat of identity theft.” 

Under announced by the FTC this month, Illuminate will be required to create a “comprehensive information security program,” delete any student data it is no longer using and notify the commission of any future data breaches. Regulators allege a third-party company hired by Illuminate to assess its cybersecurity safeguards raised red flags but Illuminate failed to heed those warnings a year before it was hacked using the compromised credentials of a former employee.

“Illuminate pledged to secure and protect personal information about children and failed to do so,” Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said in a media release this month. The FTC action, Mufarrige continued, should serve as a warning to other companies that the commission “will hold them accountable if they fail to keep their privacy promises to consumers, particularly when it involves children’s medical diagnoses and other personal data.”

After the data breach, which affected the country’s two largest school districts in New York City and Los Angeles among others, Illuminate was by another education technology company, in 2022. Since then, a Renaissance spokesperson said in a statement to ����Ӱ�� this week, Illuminate products have been incorporated into its “cybersecurity and data protection program.” 

“robust security protocols and controls used to safeguard the integrity and confidentiality of the data entrusted to us by schools, educators and families,” the spokesperson said.

The FTC action comes on the heels of last month, when state attorneys general in California, Connecticut and New York secured a combined $5.1 million in penalties from Illuminate, along with cybersecurity requirements that resemble the FTC’s demands. State investigators similarly alleged sweeping security flaws at the company, including the failure to monitor suspicious activity and deactivate the inactive user accounts of former employees. 

A California Department of Justice that Illuminate made “false and misleading statements” about its cybersecurity safeguards in its privacy policy and “deceptively advertised” to school districts that it was a signatory of the nonprofit Future of Privacy Forum’s now-defunct “Student Privacy Pledge.” 

The voluntary pledge, , sought to hold education technology companies accountable for maintaining “a comprehensive security program” to protect students’ personal information and to prevent the sale of student records for targeted advertising. 

Illuminate became the first ed tech company to get booted from the pledge after reporting by ����Ӱ�� called into question its utility in holding tech firms accountable for failing to meet its provisions. 

The multistate Connecticut regulators reached a settlement under its state student data privacy law — which was enacted nearly a decade ago. 

“Technology is everywhere in schools today, and Connecticut’s Student Data Privacy Law requires strict security to protect children’s information,” Connecticut Attorney General William Tong said in a statement. The settlement “holds Illuminate accountable and sends a strong message to education technology companies that they must take privacy obligations seriously.”

The Massachusetts teenager set to be sentenced next week for  was a “seasoned cybercriminal” who has targeted educational institutions, government agencies and corporations since 2021, my latest investigation reveals. 

Good morning and thank you for tuning in for a special edition of . Today, I turn your attention to Matthew Lane, who was a 19-year-old college freshman when he pleaded guilty earlier this year to carrying out a cyberattack on PowerSchool, stealing sensitive data from millions of students and teachers and leveraging it into 

In my latest story published this morning, I reveal how  according to threat intelligence research conducted by the cybersecurity company Cyble and provided exclusively to ����Ӱ��. The company’s findings, which mirror sentencing documents released by federal prosecutors on Wednesday, conclude that Lane used advanced techniques to take down his targets including PowerSchool — a cyberattack attack that represented “a predictable escalation rather than an isolated incident.”

Federal prosecutors used similar language, maintaining that Lane’s “crimes were not a mistake resulting from an isolated lapse in judgment,” but rather part of a pattern of criminal cyber activity that dates back to at least 2021.

In an analysis of digital fingerprints and data breaches, Cyble analysts concluded that Lane had been  when he was still in high school. Targets included an alcoholic beverage company, a major U.S. supermarket chain, an Indonesian telecommunications company and the Colombian armed forces, Cyble said. In Wednesday’s memo, prosecutors allege that Lane has hacked at least eight targets, including “foreign government entities.” To this day, prosecutors said, most of the millions of dollars he extorted remains unaccounted for.

In federal district court in Worcester, Massachusetts, on Tuesday, they will ask the judge to sentence Lane, who was known to many in his life as a soft-spoken gamer and skilled computer programmer, to seven years in prison and more than $14 million in restitution.