BROOKLYN, N.Y. (Legal Newsline) – Illuminate Education faces a lawsuit over a data breach connected its Pupilpath online and app platforms.
Sarah Chung filed a class action May 26 in New York federal court alleging Illuminate failed to inform her in an adequate time of the breach. It says the company also failed to take industry-standard measures to protect users’ personally identifiable information.
The breach took place Dec. 28, 2021, through Jan. 8, 2022. The suit says nearly 2 million students in five states are known to have been impacted by the breach, with 820,000 current students in 567 schools in New York.
“For weeks after the cyberattack took place, Illuminate failed to notify New York City schools that personal information had been compromised back in January,” the suit says. “Finally, on or about March 25, 2022, Defendant notified the NYC Department of Education that its system had been breached.
“The DOE notified the police department and other law enforcement agencies although the FBI was already involved in the investigation.
“Defendant’s delayed reaction violates New York’s Education Law… strengthened to protect student data privacy in 2019, which requires that affected schools must be notified of any data breach ‘without unreasonable delay but no more than seven calendar days from the date of discovery of such breach.’”