Frontline Education breach hits over 1.3 million school staff and students

Frontline Education, which sells administration software to K-12 school districts, is notifying more than 1.3 million people that their personal information was stolen in a breach. The company says the incident happened on August 14 and involved someone exploiting a vulnerability in a third-party software product to get into Frontline's environment. It says it fixed the defect, reinforced security, and had the attack fully contained by August 15.

The stolen records came from Frontline Central and School Health Management. What was taken varies by person: names, Social Security numbers, dates of birth, driver's license numbers, passport and other government ID numbers, health insurance details such as Medicaid IDs, and Student IDs.

Frontline hasn't published a total. The 1,298,917 figure comes from breach filings with the attorneys general of Massachusetts, New Hampshire, South Carolina, Texas and Vermont. The company also filed in California, Indiana and Iowa, and possibly in states without public breach portals, so the real total is likely above 1.3 million. SecurityWeek says it asked Frontline for more and will update if the company answers.

Notifications are going out by email or US mail, coordinated with the affected districts. Adults are being offered two years of free credit monitoring and identity-theft protection; minors who qualify get dark-web monitoring.

The advisory doesn't name the third-party product or the vulnerability, which is the part districts can't check for themselves. For now the practical question for a school district is whether it has heard from Frontline directly, and which of its staff and student records sat in those two products.