Attorney General Tong Enters into Settlement in First Action Under Student Data Privacy Law

Press Releases

11/06/2025

Attorney General Tong Enters into Settlement in First Action Under Connecticut’s Student Data Privacy Law

Illuminate Exposed Personal Information of Millions of Students in New York, California, and Connecticut 

(Hartford, CT) – Attorney General William Tong together with California Attorney General Rob Bonta and New York Attorney General Letitia James at this time introduced that they’ve secured a complete of $5.1 million from academic expertise firm Illuminate Education, Inc. (“Illuminate”), an entirely owned subsidiary of Renaissance Learning, Inc., for failing to guard college students’ information. Illuminate gives software program to colleges and faculty districts throughout the nation to trace college students’ attendance and grades and to observe college students’ educational, behavioral, and psychological well being growth. In 2022, Illuminate skilled a knowledge breach that uncovered the non-public info of hundreds of thousands of scholars, together with 28,610 college students in six faculty districts in Connecticut. An investigation by the Office of the Attorney General discovered that Illuminate did not implement fundamental safety measures to guard college students’ information, together with failing to observe for suspicious exercise on their platforms. As a results of at this time’s settlements, Illuminate should take steps to boost and strengthen its cybersecurity practices in addition to pay $5.1 million in whole.

Today’s motion is the primary such settlement reached beneath Connecticut’s Student Data Privacy Law, which was enacted in 2016 and amended in 2017 and 2018. Among different issues, the legislation requires on-line academic suppliers to take care of information safety measures that meet or exceed business requirements and which might be designed to guard pupil information from unauthorized entry or disclosure.

“Technology is everywhere in schools today, and Connecticut’s Student Data Privacy Law requires strict security to protect children’s information. Illuminate failed to implement basic safeguards, and exposed the personal information of millions of students, including thousands here in Connecticut. This action—Connecticut’s first ever under the Student Data Privacy Law—holds Illuminate accountable and sends a strong message to education technology companies that they must take privacy obligations seriously,” mentioned Attorney General Tong.

“Students, parents, and teachers should be able to trust that their schools’ online platforms are safe and secure,” mentioned Attorney General James. “Illuminate violated that trust and did not take basic steps to protect students’ data. Today’s settlements will ensure that Illuminate protects students’ data in classrooms across the country. My office will continue to use every tool at our disposal to protect children online.”

“Illuminate failed to appropriately safeguard the data of school children, resulting in a data breach that compromised the sensitive data of students nationwide, including more than 434,000 California students. Our investigation revealed a troubling pattern of security deficiencies that should have never happened for a company charged with protecting data about kids,” mentioned Attorney General Bonta. “Today’s settlement should send a clear message to tech companies, especially those in the education space: California law imposes heightened obligations for companies to secure children’s’ information. I am grateful to Attorney General James and Attorney General Tong for their partnership in investigating companies that fail to safeguard our residents’ data. Data security concerns know no borders, and as today’s settlements showcase, neither should state collaboration.”

In December 2021, hackers had been in a position to entry one in every of Illuminate’s on-line accounts utilizing the credentials of a former worker who had left the corporate years earlier. The hackers then downloaded unencrypted database recordsdata containing the knowledge of 28,610 college students in six Connecticut faculty districts. The pupil info included pupil names, delivery dates, pupil ID numbers, and demographic info.

The Office of Attorney General decided that Illuminate had did not make use of affordable information safety practices designed to guard college students’ private info.

As a results of at this time’s settlements, Illuminate should pay $5.1 million, of which Connecticut will obtain $150,000 the place 28,610 college students had been impacted; New York will obtain $1.7 million the place 1.7 million college students had been impacted; and California will obtain $3.25 million the place 3 million college students had been impacted.
Illuminate can also be required to undertake measures to higher defend college students’ private info, together with:

1. Reviewing and conforming all contracts with Connecticut faculty districts to adjust to the Student Data Privacy Law.
2. Employing particular safeguards, together with sustaining information inventories, minimizing information and limiting information retention to its particular objective;
3. Employing correct entry controls and authentication;
4. Performing information safety threat assessments and penetration assessments;
5. Establishing a proper to delete information;
6. Monitoring distributors;
7. Obtaining an info safety evaluation from the third-party assessor.

Assistant Attorneys General John Neumon and Kileigh Nassau, in addition to Deputy Associate Attorney General and Privacy Section Chief Michele Lucan, assisted the Attorney General on this matter.

For extra info on the Student Data Privacy legislation, please see: Student Data Privacy

Click right here for Connecticut’s submitting.

Twitter: @AGWilliamTong

Facebook: CT Attorney General

Media Contact:

Elizabeth Benton
[email protected]

Consumer Inquiries:

860-808-5318
legal [email protected]