Ed. Dept. bans online grade book after breach exposes personal data of over 800,000 students

The city Education Department is barring public schools from continuing to contract with the company behind a widely used online grade book after the program suffered a major breach that exposed the personal data of more than 800,000 students.

Education Department officials had already raised some red flags about cybersecurity protocols at the California-based Illuminate Education, the company behind the widely used Skedula and PupilPath platforms following the investigation of the January security breach, but hadn’t previously barred the product in city schools.

But in an email to principals Tuesday, First Deputy Schools Chancellor Dan Weisberg said, “Based on reviews of matters related to Illuminate’s security posture and response to the incident ... we are directing all schools to cease using any Illuminate products and services after June 30, 2022.”

Skedula and PupilPath are used in hundreds of city schools to track grades and attendance and communicate with parents. The platforms abruptly shut down in January, prompting concerns of a hack.

But it wasn’t until March that education officials revealed the massive scale of the breach, which affected personal information of roughly 820,000 current and former students and may be the single largest student data breach in U.S. history.

Education Department officials also raised concerns in March about Illuminate’s cybersecurity protocols, accusing the company of falsely claiming that all of its student info was encrypted when in fact some of it was left unencrypted. The company did not respond to that allegation at the time, and did not return a request for comment about Tuesday’s ban of Illuminate products.

The ban means that hundreds of city schools that have relied on the platform for core daily functions will have to find an alternative by next school year.

The Education Department recently announced plans to roll out its own inhouse grading and attendance platform, which Weisberg said will be able to accommodate all schools forced to drop Illuminate products. The agency is also working on a list of other approved third-party vendors, Weisberg said.