The Ghost Of Employees Past: The Data Breach Risks From User-Credential Management

A recent settlement with an education service provider and three states – California, Connecticut, and New York – serves as a reminder to deactivate the credentials of departed employees. The case arose following a data breach suffered by Illuminate Education, which provides assessment software to K-12 school systems. As part of its services, the company stores sensitive details like students' special education and accommodation needs.

In 2021, a hacker accessed the company's network using the administrative-level credentials of a former employee. The hacker created new accounts and exfiltrated the personal information of millions of students. The states alleged that failing to turn off the credentials of the former employee directly led to the 2021 breach. This, they argued, was a violation of their respective student privacy laws and was an unfair trade practice.