FTC Gives Final Approval to Order Against Illuminate Settling Allegations It Failed to Secure Students’ Personal Data

## Executive summary The FTC finalized an order against Illuminate Education after alleging that security failures allowed a hacker to access personal data for 10.1 million students (including contact details, dates of birth, student records and health information); the order requires deletion of unnecessary data, limits on data collection and retention, establishment of a comprehensive information security program, and prohibitions on misrepresenting security and breach-notification practices.