Data on more than 10 million students was revealed in a breach
-
Over 10 million students' personal data was exposed in a major breach at Illuminate Education
-
The company failed to secure student health records, addresses, and other sensitive information for years
-
Parents can take steps now to protect their children's data at school
If your child attends public school, there's a good chance their personal information is stored by education technology companies you've never heard of. A major FTC action announced this week shows just how vulnerable that data really is.
What happened to millions of students' data
The Federal Trade Commission took action against Illuminate Education on December 1, 2025, after the Wisconsin-based company suffered a massive data breach that exposed personal information of more than 10 million students.
Here's what went wrong: In late December 2021, a hacker used login credentials from a former employee who had left the company three and a half years earlier. The breach exposed students' email addresses, home addresses, dates of birth, student records, and health information.
The company had promised schools it would protect student data "like it's our own" and claimed to use industry best practices. But the FTC found Illuminate failed to implement basic security measures, including storing student data in plain text format until at least January 2022.
Even worse, some school districts weren't notified about the breach for nearly two years, affecting over 380,000 students whose families had no idea their children's data had been compromised.
How to protect your child's school data
You can't control every tech company your school district uses, but you can take these steps to minimize risks:
-
Ask your school district which education technology companies have access to your child's data and what information they collect
-
Request a copy of your child's educational records to see what personal information is being stored
-
Find out your district's data breach notification policy and ask to be contacted immediately if any breach occurs
-
Review and limit what optional information you provide on school forms - only give what's absolutely necessary
-
Monitor your child's school email account regularly for any suspicious activity
-
Teach older children about protecting their login credentials and recognizing phishing attempts
What schools must do differently now
The FTC's settlement requires Illuminate Education to implement stronger security measures, including deleting unnecessary personal information and establishing a comprehensive data security program. The company must also notify the FTC about any future breaches involving consumer data.
This case sends a clear message to other education technology companies that they'll be held accountable for protecting student privacy.
The bottom line: Your child's personal information is only as secure as the weakest link in your school district's technology chain. While you can't control every company that handles student data, staying informed about your district's privacy policies and asking the right questions can help protect your family from future breaches.
Posted: 2025-12-01 19:22:25















