"We Take Security Seriously" Only Works If the Controls Are Real

This post is informational and reflects the state of the matter as of June 2026. For your own security posture, consult a licensed attorney.

“We take the security of your data seriously” is one of the most common sentences on the internet. The Federal Trade Commission’s action against Illuminate Education is a reminder that the sentence is a representation, and it only holds up if the controls behind it are real.

The FTC gave final approval to its order against Illuminate, an education-technology provider, over a breach that exposed the personal data of more than 10 million students, including contact information, dates of birth, student records, and health-related information. The alleged entry point is the part worth sitting with: a hacker used credentials tied to a former employee who had left the company roughly three and a half years earlier. The FTC also alleged Illuminate had been warned about serious security weaknesses well before the breach and did not fix them.

The lesson is not “have security.” It’s “have the specific controls you claim.”

Two things about the order make it useful beyond this one company.

First, the breach traces to basic access hygiene, not an exotic attack. A departed employee’s credentials should not still work years later. That is identity and access management, and it is exactly the kind of control a privacy policy implies when it promises reasonable security.

Second, the FTC made data minimization part of the remedy. The order requires Illuminate to delete data it does not need and to publish and follow a retention schedule that ties data it keeps to a specific purpose and a defined deletion timeframe. Retention is being treated as a security control, not just a privacy nicety: data you no longer hold cannot be stolen.

A four-point self-check

Access. Who still has access across Active Directory, cloud IAM, SaaS tools, vendor integrations, API keys, shared accounts, admin consoles, and service accounts? When someone leaves, does their access actually get removed, everywhere, promptly?
Retention. Do you have a written retention schedule that names a purpose and a deletion timeframe, or does your data just accumulate?
Promise versus practice. Does your privacy policy promise controls you can actually point to (MFA, access reviews, logging, vulnerability remediation, retention limits, deprovisioning)? A promise you cannot demonstrate is the exposure.
Vendors. Do your SaaS vendor contracts require prompt removal of access when a user leaves, and can you verify it happened?

The Illuminate order is not surprising law. It is a plain reminder that the security sentence in your privacy policy is enforceable, and that the FTC will read it against what your controls actually do. (For how this fits with your privacy program, see the firm’s Privacy & Data Security practice.)

If your privacy policy promises security controls and you are not certain they hold up, talk to MB Legal.

This post is informational and does not constitute legal advice. It describes an FTC enforcement action resolved by order; see the FTC’s announcement for the primary source. For guidance on your situation, consult a licensed attorney.