In May 2026, the California Supreme Court ruled against the plaintiff in J.M. v. Illuminate Education, finding that the ed-tech company was not a "provider of health care" under California's Confidentiality of Medical Information Act and that the plaintiff had not sufficiently pleaded his claims. Illuminate won. The case was dismissed.
But the same ruling established something that favors future plaintiffs. Under the CMIA, proof that data was actually viewed by an unauthorized party is no longer required. A "significant risk" of unauthorized access or use is now sufficient.
Joe Earle, cyber group practice leader at C3 Risk and Insurance Services, described the dual nature of the decision at a recent Insurance Business cyber roundtable. "It's an interesting case because Illuminate actually won this one. But the precedence changed a lot of things because the threshold of data being breached - we don't have to have a hacker look at it or it to be leaked. It just has to be a significant risk of it being breached. And with CMIA fines of $1,000 per record, those breaches can get pretty big, pretty fast."
The litigation outcome has to be read alongside what happened outside the courtroom.
Despite prevailing in the class action, a coalition of three state attorneys general secured a $5.1 million settlement from Illuminate in 2025. The Federal Trade Commission reached a separate settlement with the company the same year over failures to protect the personal and medical data of more than 10 million students.
A defense win in class action litigation did not prevent meaningful enforcement consequences. For any company handling educational, medical, or medical-adjacent data, civil litigation and regulatory enforcement remain parallel tracks - both live even when the litigation fails.
Keith Savino, CEO US at Emergence Insurance, placed the decision in its broader market context. "Every claim, particularly substantial claims or something that could turn into a surge in class actions, is going to have an impact on the industry and on their guidelines and on their appetite. So you might see this impact certain classes of business more than others."
Healthcare is the class all three panelists named as most directly affected. But any class handling large volumes of personally sensitive data - education technology, financial services, healthcare-adjacent businesses - is now operating in a litigation environment that has become more plaintiff-friendly on standing.
Jennifer Wilson, senior director, cyber at WTW, connected the Illuminate ruling to a shift the market has seen before.
"I think that the Illuminate case is very reminiscent to what we saw in the Six Flags decision as it relates to biometrics,” she said. “It's no longer about the potential economic loss. It's more about the potential exposure. So you don't need to prove damages in order to recover."
The Six Flags biometric litigation reshaped how companies holding biometric data in Illinois assessed their exposure under BIPA, because plaintiffs no longer needed to demonstrate actual harm - only that the statute had been violated. The CMIA standard clarification in Illuminate operates on the same axis.
That shift in what plaintiffs need to demonstrate is structural, not case-specific. Underwriters writing classes that touch sensitive personal data need to be assessing how their policies would respond to a claim framed around "significant risk" rather than demonstrated harm.
Savino's market segmentation point is the most practically useful for brokers managing a mixed book. "If we're speaking about the SMB or SME space, you answer it one way. If you're speaking about larger accounts, you might answer it another way,” he said.
New business acquisition competition will keep SME pricing competitive. Rate discipline, walking away from unfavorable deals, and appetite tightening on data-sensitive classes are concentrated in the larger account segment - and in the healthcare and education-adjacent classes most directly affected by the Illuminate precedent.
Wilson expects a shift, not a reversal. "I don't think we're at risk of an overcorrection by the market, but I do believe that we are going to start seeing a course correction over the next 12 months. We're already seeing carriers start to hold rate and walk away from big deals because they don't want to offer significant decreases. So I think gone are the days of the significant race to the bottom."
Earle's counterweight explains why the correction stays modest. "I'm going to bet on the market staying stable. We have too many new entrants into the cyber insurance market, too much VC money, and underwriting has gotten better and cybersecurity in general, including backups, has gotten better, which has caused ransomware claims to not be paid as much,” he said.
The litigation environment is moving in one direction. The competitive dynamics are pulling in another. Brokers placing data-sensitive risks need to be watching both.
