how it happened
- whothreat actortried several sets of credentials
- the gapold cloud key pairallegedly never disabled or rotated
- thennew user createdcould bypass the MFA requirement
- the resultstudent data copiedover 10.1 million students in the backups
what everyone assumed
Credentials feel perishable. A person leaves, the company moves on, the tools change, and anything tied to that person fades from relevance long before it could matter. After years, it is a reasonable guess that an old key has been cleaned up by someone, or at least that attackers would have no way to know it exists. Careful teams hold this belief because nothing in daily work ever contradicts it. A key that still works looks the same as a key that is gone, until somebody uses it.
what happened
The statements about the breach below are allegations from the complaint of the US Federal Trade Commission (FTC). The case was settled without a trial.
According to the FTC complaint, the intruder entered through an existing access key pair for an AWS IAM user, a finding the complaint attributes to the third-party incident response team. The key pair belonged to a former employee with IAM administrator privileges. The complaint says that employee left in April 2018, over three and a half years before the breach, and that Illuminate did not disable or rotate the key pair.
The complaint is not consistent about the age of the credentials. One passage dates the departure to April 2018. Another passage says Illuminate’s own analysis found the credentials to be approximately 10 years old. This page does not choose between them.
The complaint says the actor tried 5 different sets of credentials against the account and only the former employee’s set worked. With that administrator access, the complaint says, the actor generated a token and created a new user that could bypass the multi-factor authentication (MFA) requirement. The complaint also says Illuminate had not enforced single sign-on and MFA on its AWS services until at least April 2022.
According to the complaint, the first access was on 27 December 2021. Over 13 days the actor changed security groups, reset database passwords, deleted database resources and took 787 SQL server backups, and none of this triggered detection. How the actor came to hold the old key pair is not stated in the complaint.
The complaint also describes earlier warnings. It says a third-party assessment in January 2020 gave Illuminate an overall “C” and flagged weak identity and access management practices and weak credentials. It says the same assessor found in February 2021 that these were still not addressed. It says a Director of Data Privacy and Security hired in October 2021 noted inadequate controls for theft detection and monitoring.
step by step
- April 2018an administrator leavesThe FTC alleges the key pair of this IAM user with administrator privileges was not disabled or rotated.the assumption breaks here
- 27 December 2021an intruder gets inAccording to the incident response findings quoted in the complaint, the first access was with that old key pair.
- the intruder works for 13 daysThe complaint says the actor changed security groups, reset database passwords, deleted database resources and took 787 SQL server backups without triggering detection.
- 8 January 2022an automated alert firesSeveral websites became unavailable, engineers found malicious activity and access was terminated.
how it surfaced
On 8 January 2022 an automated alert reported that several websites had become unavailable. Engineers found malicious activity and terminated the access, according to the complaint. The complaint says the investigation concluded around 25 March 2022 and that most schools received initial notifications between March and July 2022.
The complaint says Illuminate’s database backups contained some or all of the personal information of more than 10.1 million students, and the FTC press release of 1 December 2025 repeats that figure. The complaint does not say the data was misused. It says Illuminate paid an undisclosed ransom, that the actor did not return all the data, and that deletion cannot be verified. In October 2023, according to the complaint, nearly 387,000 further current and former students were identified as affected and notified.
The FTC announced a proposed consent order on 1 December 2025 and finalised it on 5 June 2026, both by a 2-0 Commission vote, according to its press releases. The 1 December release describes terms that include a comprehensive information security program and deletion of personal data that is no longer needed. This page did not check the final order text and does not quote it.
The FTC alleges that the key of a departed administrator was still the way in, years later.
Age is a property of a key that nobody reads off the key itself. The only way to know whether an old credential is dead is to look it up, and the cloud account will tell you.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersYears later someone finds it, tries it, and it still works.what it costs youYour customers' records leave through a door that was meant to be shut long ago.
- or it goes like thisit happenedCash App / Block, 2022howThe person logs back in from home, weeks after leaving.what leavescustomer lists and reportswho ends up with itthe former employee and whoever they work for next
- or it goes like thisit happenedColonial Pipeline, 2021howThe forgotten account's password turns up in a breach dump.what leavesa working way into the networkwho ends up with ita ransomware crew
sources
- Federal Trade Commission: Illuminate Education, Complaint (docket 222-3105)
- Federal Trade Commission: FTC Takes Action Against Education Technology Provider for Failing to Secure Students' Personal Data, 1 December 2025
- Federal Trade Commission: FTC Gives Final Approval to Order Against Illuminate Settling Allegations It Failed to Secure Students' Personal Data, 5 June 2026
your turn
what you can do about it
this week
Export your cloud access key report and disable every key that belongs to someone who has left.
In AWS this is the IAM credential report. Sort it by key age, then disable the keys of former staff and the keys nobody has used for months. Then check that every remaining admin identity requires MFA. The FTC alleges that an old administrator key and a missing MFA rule were both present at Illuminate, and both are visible in that report.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →