Pearson plc

In August 2021, Pearson plc agreed to pay a $1 million civil penalty to settle U.S. Securities and Exchange Commission charges over disclosures relating to a 2018 cyber intrusion. The SEC found that the breach involved the theft of millions of student records and administrator login credentials from approximately 13,000 school, district and university customer accounts. According to the SEC, Pearson later described a data-privacy incident as a hypothetical risk even though the breach had already occurred, understated the nature and scope of the incident in a media statement, and overstated the strength of its data protections. The SEC also found deficiencies in Pearson's disclosure controls and procedures. Pearson settled without admitting or denying the findings. Source: U.S. Securities and Exchange Commission https://www.sec.gov/newsroom/press-releases/2021-154