California, New York, and Connecticut fined educational technology company Illuminate Education Inc. $5 million for exposing data covering millions of kids in a 2021 breach.
The settlement marks the first enforcement action of its kind under California’s and Connecticut’s respective laws mandating providers of online services used by schools to implement basic security procedures to protect student data. The breach also violated New York’s state law, which has similar requirements.
“Our investigation revealed a troubling pattern of security deficiencies that should have never happened for a company charged with protecting data about kids,” California Attorney General Rob Bonta said in ...