The Federal Trade Commission (FTC) recently announced that it agreed to proposed consent orders with two companies that experienced recent cybersecurity incidents, Illuminate Education (“Illuminate”) and Illusory Systems, which does business as Nomad (“Illusory”), to resolve allegations that both companies’ information security practices had violated Section 5 of the FTC Act.  Both consent orders include information security-focused elements that have frequently been included in prior settlement settlements, such as requirements to establish an information security program and conduct periodic third-party assessments.  However, both consent orders are set to expire after ten years, as opposed to the twenty years set by longstanding FTC policy for administrative orders.

We have summarized the key elements of both consent orders below. The proposed consent orders are subject to 30 days of public comment before finalization.

Illuminate Education

Illuminate is an education technology company that provides educational software, web applications, and tools to schools and school districts to support Pre-K–12^th grade education.  According to the FTC’s Complaint, from December 2021 to January 2022, Illuminate experienced a data security incident involving more than 10 million students’ personal data when hackers exploited login credentials from a former employee who had left the company more than three years earlier.  The FTC alleged in its Complaint that Illuminate violated Section 5 of the FTC Act by engaging in unfair and deceptive acts or practices—specifically, by failing to implement reasonable and appropriate cybersecurity measures to protect personal information; misrepresenting the extent to which it had implemented reasonable cybersecurity measures; and failing to timely notify school districts of a data breach, contradicting its commitments to those school districts.

The FTC’s Complaint detailed Illuminate’s security acts and practices that it alleged fell below a “reasonable” standard of cybersecurity. These included, among others:

• Until January 2022, storing students’ personal information in plaintext within Illuminate’s network;
• Failing to implement reasonable access controls to safeguard student data, such as by auditing and removing inactive accounts;
• Failing to implement reasonable data retention practices and procedures; and
• Failing to timely notify impacted school districts and individuals of the data breach.

The Complaint also alleged that a third-party vendor notified Illuminate of “numerous” security weaknesses as early as 2020, but Illuminate failed to take necessary steps to rectify them.

To resolve the FTC’s claims, the proposed consent order between the FTC and Illuminate would require Illuminate to, for example:

• Establish and maintain a comprehensive information security program meeting specific requirements outlined in the order, including strict limitations on access controls such as the use of MFA and periodic access reviews, data inventory and classification requirements, and obligations for periodic briefings to the company’s Board on the program;
• Avoid misrepresenting Illuminate’s privacy and cybersecurity protections and the timeframe in which Illuminate will notify impacted individuals and school districts of a data breach;
• Delete personal information that it does not need to provide its services;
• Impose new data retention limits on the personal information that it holds, and publish those retention schedules publicly;
• Periodically obtain third party information security assessments;
• Submit an annual certification from Illuminate’s Chief Information Security Officer (“CISO”) to the FTC regarding compliance with the order; and
• Notify the FTC of qualifying security incidents.

As noted above, the proposed consent order (including the above-mentioned requirements) would terminate ten years after its issuance date, a shorter duration than many administrative orders that were issued in recent years.

Illusory

According to the FTC’s Complaint, Illusory, a company that provides a “cross-chain bridge” platform to transfer messages and assets, experienced a security incident in 2022 causing more than $100 million in asset losses after malicious actors exploited a code vulnerability introduced into Illusory’s smart contract offering.  In a Complaint, the FTC alleged that Illusory violated Section 5 of the FTC Act by engaging in unfair and deceptive conduct—including by failing to implement reasonable software development practices that led to the security incident, and by misrepresenting the adequacy of Illusory’s existing secure software development practices.

The FTC announced a proposed consent order to resolve the claims, which includes many provisions similar to the Illuminate order described above, and which would require Illusory to, for example:

• Establish and maintain a comprehensive information security program meeting requirements specified in the order, including implementing “a way to quickly pause or limit the functioning of” a system that allows irrevocable actions such as unrecoverable transfer of funds “if it exhibits unexpected behavior”;
• Avoid misrepresenting its implementation of secure software development practices or protection of consumers’ financial assets;
• Periodically obtain third party information security assessments;
• Submit an annual certification from Illuminate’s Chief Executive Officer (“CEO”) to the FTC regarding compliance with the order; and
• Return to consumers the assets recovered after the security breach, to the extent they were not already returned.

Similar to the Illuminate consent order above, the consent order for Illusory would also expire after ten years.