FTC Data Security Settlement 2026: The Illuminate Student-Data Order
Reference Guide
The FTC data security settlement 2026 searches keep landing on is the order against Illuminate Education, a K-12 software company whose breach exposed records of 10.1 million students, according to the FTC. The FTC made the order final on June 5, 2026. It forces security and data-deletion rules on the company for 10 years. It pays families nothing, and there is no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What the FTC Says Went Wrong
Illuminate sells cloud software that schools use for student records and assessments, including products called eSchoolData, eduCLIMBER, DnA, FastBridge and SchoolCity. Students and parents never signed up with it; their school district did.
According to the FTC complaint, in late December 2021 a hacker logged in with the credentials of a former employee who had left about three and a half years earlier. The FTC says the intruder reached personal data of 10.1 million students: email and mailing addresses, dates of birth, student records and health-related information.
The FTC alleges a vendor had warned Illuminate about security holes as early as January 2020, that student data sat in plain text until at least January 2022, and that the company waited nearly two years to tell some districts, covering more than 380,000 students. Illuminate neither admitted nor denied the allegations.
Case details
This is an FTC administrative case, not a court case: In the Matter of Illuminate Education, Inc., FTC File No. 222 3105, Docket No. C-4833. The FTC announced the proposed order on December 1, 2025, took public comment, and voted 2-0 to finalize a modified version on June 5, 2026. The FTC press release and the FTC case page are the primary sources.
Separately, the attorneys general of California, Connecticut and New York announced $5.1 million in settlements with Illuminate on November 6, 2025. That money is paid to the states, including $3.25 million in civil penalties to California.
Status: Final Order, No Consumer Money
What the order does: Illuminate must delete data it does not need, publish a data retention schedule, run a comprehensive information security program, cut off departed employees’ access within 30 days, and tell the FTC whenever it reports a breach to another government agency. Each future violation can draw a civil penalty of up to $51,744.
Other 2026 FTC privacy settlements with money attached — RentGrow and Amazon, $2.25 million each — are Fair Credit Reporting Act cases, not data breach cases.
Was Your Child’s Data Involved?
The breach touched students in districts that used Illuminate software. In California alone, the attorney general counts three million affected students across 49 school districts, more than 434,000 of them with sensitive information such as special-education status and coded medical conditions.
Your school district is the one to ask. Illuminate held the data on the district’s behalf, and notices went out through districts — some of them, the FTC says, nearly two years late.
Being affected does not make you part of any payout. The FTC order and the state settlements are government actions; neither creates a class you can join.
Why This Settlement Pays Nothing to Families
The $5.1 million the states collected went to the states, not to families. Private suits are the usual route to individual money, and they have not succeeded here: per Bloomberg Law, the California Supreme Court ruled for Illuminate on the plaintiff’s medical-privacy and customer-records claims and sent the case back to the Court of Appeal to decide whether he may amend. We found no class settlement.
Compare a breach that did produce a consumer fund: the T-Mobile data breach settlement.
Illuminate Breach and FTC Order Timeline
January 2020 — The Warning
Per the FTC complaint, a third-party vendor alerts Illuminate to numerous security vulnerabilities on its network.
December 2021 — The Breach
A hacker uses a former employee’s still-active credentials to reach student databases on a third-party cloud, the FTC alleges.
November 6, 2025 — Three States Settle
California, Connecticut and New York announce $5.1 million in settlements plus security terms. Connecticut’s is the first action under its Student Data Privacy Law.
December 1, 2025 — FTC Proposes Its Order
The FTC announces the proposed consent order and opens a 30-day public comment period.
June 5, 2026 — Order Made Final
The Commission votes 2-0 to finalize a modified order, Docket No. C-4833, after answering three comments.
October 2026 — Under Order
The order is in force for 10 years from June 5, 2026. No consumer fund, no claim form and no deadline exist.
Three Things to Watch For
“FTC settlement” plus “your child’s data” is an easy hook, because parents rarely know which vendor their school uses:
“Claim your Illuminate student-data payment”
There is no fund and no claims site. A page asking for your child’s date of birth or student ID to “release a payment” is collecting exactly the data the breach exposed.
Callers or emails “from the FTC”
The FTC says it will never demand money, make threats, tell you to transfer money or promise you a prize. Report such contacts at ReportFraud.ftc.gov.
“Recover your Nomad crypto” offers
The FTC’s separate Nomad crypto-bridge case involves stolen funds, which makes it bait for recovery scams. No legitimate recovery requires an upfront fee or your wallet’s private keys or seed phrase.
FTC Data Security Settlement 2026 — Questions People Actually Ask
Short answers to the questions people ask most about this case.
What is the FTC data security settlement in 2026?
The FTC’s 2026 data security order is against Illuminate Education, finalized June 5, 2026 (Docket No. C-4833). The FTC alleges weak security let a hacker reach data of 10.1 million students. The order imposes security and data-deletion requirements for 10 years. If you searched ftc data security settlement 2026 -site:wikipedia.org to skip encyclopedia results, this order is the case those results point to.
Do I get money from the FTC Illuminate settlement?
No. The order has no consumer fund, no claim form and no deadline. The separate $5.1 million state settlements are paid to California, Connecticut and New York, not to families.
How do I know if my child’s data was in the Illuminate breach?
Ask your school district. Illuminate held student data on behalf of districts, and notifications went through them. In California, the attorney general says students in 49 districts were affected.
What data was exposed?
Per the FTC: email and mailing addresses, dates of birth, student records and health-related information. The California attorney general adds race, special-education status and coded medical conditions for some students.
What does the FTC order actually require?
Illuminate may not misrepresent its security or how fast it will report breaches. It must delete unneeded data, follow a public retention schedule, run a comprehensive security program, remove departed staff’s access within 30 days, and report breaches it discloses to other governments to the FTC.
Why wasn’t Illuminate fined by the FTC?
FTC consent orders like this one change practices going forward. Money becomes possible if the company violates the order: up to $51,744 per violation, according to the FTC. The state attorneys general did collect $5.1 million in settlements.
Were there other FTC data security settlements recently?
Yes. On December 16, 2025 the FTC proposed an order against Illusory Systems (Nomad; we have not confirmed whether it has since been finalized), alleging security failures let hackers steal $186 million in crypto, about $100 million of it never recovered; the company must return recovered money. Before that, the FTC finalized its GoDaddy order on May 21, 2025. The FTC told Congress in February 2026 that it has brought more than 90 data security actions.
What is worth doing right now?
Ask your district whether your child was notified, and keep that letter. Consider freezing your child’s credit at the three bureaus. Ignore anyone offering an “FTC payment” for this case — none exists.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorEstimate what a breach class settlement pays per person
- Open Class Action SettlementsSettlements that are taking claims right now, with deadlines
- Fortnite FTC RefundAn FTC case that does pay consumers, and how its rounds work
- Class Action Payout CalculatorHow a settlement fund is split once claims come in