Threat watch / Breach
Frontline Education: a flaw in third-party software exposes data of 3 million school staff and students
Frontline Education, which sells software to US K-12 school districts, says a vulnerability in a third-party software product it uses allowed unauthorized access to part of its environment on August 14 and 15, 2026, in Frontline Central and School Health Management. Social Security numbers and other ID numbers of staff and students were involved. A filing with the Indiana Attorney General counts 3,085,266 people affected, according to SecurityWeek.
- Sector
- Education
- Way in
- Software flaw
- Product or vendor
- Frontline Central, Frontline School Health Management
- people affected, per Frontline's filing with the Indiana Attorney General as reported by SecurityWeek[4]
- 3.1M
- How it happened
- Frontline says its security team identified on August 14, 2026 "a vulnerability in a third-party software product we use that allowed unauthorized access to a portion of the environment". It has not named the product. The last day of unauthorized activity was August 15.[1][4] Checked 9 Nov 2026
- What was stolen
- Data from Frontline Central and School Health Management. According to Frontline, it varies by person and may include Social Security numbers, dates of birth, driver's license, passport and other government ID numbers, Medicaid IDs and student IDs. Frontline says it is not aware of any misuse.[1] Checked 9 Nov 2026
- Who was impacted
- Staff and students of US school districts using these Frontline products. Filings in Massachusetts, New Hampshire, South Carolina, Texas and Vermont counted 1,298,917 people; the Indiana filing counts 3,085,266, according to SecurityWeek. Frontline's own notice gives no number.[1][3][4] Checked 9 Nov 2026
- Threat actor
- Not attributed
Timeline
- Frontline's security team identifies a vulnerability in a third-party software product that allows unauthorized access to part of its environment. Unauthorized activity starts that day and ends on August 15. [1]
- A school district's notice to employees, shared online, makes the breach public. BleepingComputer reports it; Frontline does not answer its questions. [2]
- Frontline publishes its notice of data breach and starts notifying people, with two years of credit monitoring for adults and identity monitoring for minors. It says the incident "has been fully remediated". [1]
- SecurityWeek counts 1,298,917 people affected in filings with five state attorneys general. [3]
- SecurityWeek reports that Frontline told the Indiana Attorney General that 3,085,266 people were affected. No known group has claimed the attack. [4]