Illuminate Education Facing Class Action Over PupilPath Data Breach Affecting Millions of Students

New to ClassAction.org? Read our Newswire Disclaimer

Illuminate Education, Inc. faces a proposed class action lawsuit after its PupilPath platform was hit by a data breach in early 2022 that reportedly impacted nearly two million students across five states. 

The 10-page lawsuit says that Illuminate Education, an educational software and tech support provider whose products are used to store test results and grades, track attendance and facilitate communication with students and families, first became aware of “suspicious activity” in applications within its programs on January 8, 2022. 

The company’s subsequent investigation revealed more than two months later that “unauthorized access” to certain databases containing protected student information had occurred between December 28, 2021 and January 8, 2022, the complaint states. According to the case, Illuminate Education finally notified the New York City Department of Education, who in turn notified law enforcement, about the hack on March 25. 

The suit chides Illuminate Education for waiting until the end of March before notifying New York City schools that students’ personal information had been compromised back in January. The case alleges Illuminate Education’s delayed action is a violation of New York’s Education Law, which mandates that affected schools be notified of any data breach “without reasonable delay but no more than seven calendar days from the date of discovery of such breach.” 

Moreover, the Education Law requires that schools, in turn, notify affected individuals no more than 14 calendar days from the date the breach was discovered, the case relays. 

The suit says that rather than receive notice from Illuminate Education of the PupilPath hack, current and former students and some parents in New York received letters from the city’s Department of Education about the data security incident. 

“Defendant has yet to directly inform the students and their parents that the [personally identifiable information] has been compromised,” the filing reads. 

According to the complaint, the data breach occurred as a result of Illuminate Education’s negligent failure to protect students’ personally identifiable information. The case states that the defendant’s PupilPath platform is licensed to 5,000 schools nationwide, with a total enrollment of roughly 17 million students. 

Students who use the platform, as required by their schools’ curricula, must provide Illuminate Education with sensitive information that includes facial photographs, first and last names, dates of birth, email address and unique identification numbers, the suit says. In New York alone, 820,000 students in more than 560 schools are known to have been impacted by the incident, the lawsuit claims, stressing that the number of former students impacted is “estimated to be many folds higher than the number of current students.”

“Accordingly, students now face an increased risk of fraud, identity theft, tracking or other adverse effects,” the case states, adding that students and their parents and guardians must spend “years living in fear that unscrupulous actors may utilize their ill-gotten information.” 

The lawsuit looks to cover individuals in New York who used the PupilPath platform within the relevant statute of limitations period.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.