DOE officials had already raised some red flags about cybersecurity protocols at the California-based Illuminate Education, the company behind the widely used Skedula and PupilPath platforms following the investigation of the January security breach, but hadn’t previously barred the product in city schools.
But in an email to principals Tuesday, DOE First Deputy Chancellor Dan Weisberg said, “based on reviews of matters related to Illuminate’s security posture and response to the incident ... we are directing all schools to cease using any Illuminate products and services after June 30, 2022.”
Skedula and PupilPath are used in hundreds of city schools to track grades and attendance and communicate with parents. The platforms abruptly shut down in January, prompting concerns of a hack.
But it wasn’t until March that education officials revealed the massive scale of the breach, which affected personal information of roughly 820,000 current and former students and may be the single largest student data breach in U.S. history.
DOE officials also raised concerns in March about Illuminate’s cybersecurity protocols, accusing the company of falsely claiming that all of its student data was encrypted when in fact some of it was left unencrypted. The company did not respond to that allegation at the time, and did not return a request for comment about Tuesday’s ban of Illuminate products.
The ban means that hundreds of city schools that have relied on the platform for core daily functions will have to find an alternative by next school year.
The DOE recently announced plans to roll out its own in-house grading and attendance platform, which Weisberg said will be able to accommodate all schools forced to drop Illuminate products. The agency is also working on a list of other approved third-party vendors, Weisberg said.
©2022 New York Daily News. Distributed by Tribune Content Agency, LLC.
