Frontline Education data breach: 3M+ K-12 staff and student records stolen via third-party software flaw
Severity: high · Patch status: no-fix-needed · Since 2026-11-09
Frontline Education, a K-12 school administration software provider, disclosed that an August 2026 data breach affected 3,085,266 people — more than double the ~1.3 million previously reported to other states. Attackers exploited a vulnerability in an unnamed third-party software product to access part of Frontline's environment; the intrusion was detected on August 14 and contained the next day. Data stolen from Frontline Central and School Health Management may include names, Social Security numbers, dates of birth, driver's license and passport numbers, Medicaid IDs, and student IDs of school district employees and students. US adults receive two years of free credit monitoring; eligible minors get dark web monitoring. No group has claimed the attack and the exploited product remains unnamed.
What to do
- If your district uses Frontline Central or School Health Management, review Frontline breach notifications and enroll affected staff and students in the offered credit monitoring/dark web monitoring
- Assess exposure of employee and student PII shared with Frontline and prepare identity-theft response guidance for families
- Review third-party software supply chain and ensure vendor products integrated into your environment are patched and monitored
- Monitor for misuse of exposed SSNs and government IDs, particularly for minors
- Verify Frontline has completed remediation and request details on the exploited third-party component
Sources
All live incidents on Threat Watch
