The ed tech firm also allegedly failed to monitor its systems for suspicious activity and did not separately secure backup and active databases.