SEC Sanctions Public Company for Misleading Disclosures About Data Breach

1 Minute Read

September 1, 2021

Categories: Privacy & Cybersecurity, Regulatory

As reported on the Hunton Andrews Kurth Privacy & Information Security Law Blog, on August 16, 2021, the U.S. Securities and Exchange Commission (“SEC”) announced that Pearson plc (“Pearson”), a publicly traded British multinational educational publishing and services company, agreed to pay a $1 million civil penalty in a settlement related to charges that Pearson misled investors about a 2018 data breach resulting in the theft of millions of student records. The SEC’s order found that Pearson made material misstatements and omissions about the data breach in a report furnished to the SEC and in a media statement.

Tags: Data Breach

You May Also Be Interested In

2 Minute Read

January 21, 2026

New York Attorney General Reaches $500,000 Settlement with Orthopedics Practice Over 2023 Data Breach

The New York Office of the Attorney General recently reached a $500,000 settlement with a New York orthopedics practice for allegedly failing to protect patient and employee information in light of a 2023 data breach.

2 Minute Read

December 23, 2025

FTC Takes Action Against Illusory Systems Over $186 Million Data Breach

On December 16, 2025, the Federal Trade Commission announced an enforcement action against Illusory Systems Inc., a Utah-based company doing business as Nomad, following a major data breach in which hackers stole $186 million from consumers.

2 Minute Read

November 26, 2025

India Enacts Data Protection Rules, Introducing New Privacy Regime

Nishith Desai Associates reports that on November 13, 2025, India’s Ministry of Electronics and Information Technology enacted India’s Digital Personal Data Protection Rules, 2025, which operationalize India’s Digital Personal Data Protection Act, 2023.