The city schools chancellor is calling for an investigation of a software company after data of 820,000 students was hacked in January.
Chancellor David Banks blamed software company Illuminate Education for the hack in a statement Friday, urging the state education department to conduct a probe.
“We are outraged that Illuminate represented to us and schools that legally required, industry standard critical safeguards were in place when they were not,” Banks said in a statement Friday. “We understand how important it is that families can trust that their child’s data is protected, and we are exploring options to hold Illuminate accountable for violating that trust.”
The city Department of Education was not informed students’ data was subject to the hack until Friday, sources said.
"We are in the process of notifying customers that may have been affected. There is no evidence of any fraudulent or illegal activity related to this incident," Illuminate Education said in a statement Saturday. "The security of the data we have in our care is one of our highest priorities, and we have already taken important steps to help prevent this from happening again."
Demographic data, academic information and economic profiles were among the data accessed by the hackers, though Illuminate Education had yet to share enough details for the department to determine the breadth of the breach, sources said.
Social security numbers, family financial account information and individual education plans were not accessed, sources said. Illuminate Education does not store financial information or social security numbers, the company said.
The city school system plans to send letters to families of current and former students with explanations of what identifiable information was included in the hack, sources said. The department will review the use of Illuminate Education products following this year, according to sources.
Banks also said Mayor Eric Adams instructed him to contact the NYPD, the FBI and the New York Attorney General’s Office to investigate the hackers.
“The formal notification of a breach of students’ data by Illuminate after two months shows the company has been more concerned with protecting itself than protecting our students. This is completely unacceptable," Adams said in a statement Friday. "We will not tolerate bad actors in this city and plan to hold Illuminate fully accountable for not providing our students with the security and the timely notification the company promised.”
Illuminate Education produces software that collects data on students to help educators evaluate their pupils’ progress, according to the company’s website. The city uses numerous programs offered by the company, including IO Classroom, Skedula, and Pupilpath, sources said.