Frontline Education Data Breach Impacts Over 1.3 Million

What it is

Frontline Education, a K-12 school administration software vendor, is notifying affected people after an August 14 intrusion. The page does not name the exploited third-party product or the vulnerability. Frontline says it fixed the security defect and contained the attack by August 15.

Preconditions / Affected

Only data held in Frontline Central and School Health Management is named as stolen. Records vary by person and may include:

• names, dates of birth and Student IDs
• Social Security numbers
• driver's license, passport and other government ID numbers
• health insurance information such as Medicaid IDs

Both school district staff and students are covered.

What to do

Frontline has notified affected school districts first. With those districts, it is notifying individuals by email or by US Postal Service letter, where contact details are available. A district that uses either product should expect the notice through that channel and can confirm its exposure with Frontline.

Frontline offers US adults two years of free credit monitoring and identity-theft protection. Qualified minors get free dark-web monitoring.

Caveats

Frontline has not published a victim count. The figure of 1,298,917 comes from filings with the attorneys general of Massachusetts, New Hampshire, South Carolina, Texas and Vermont. Frontline also filed notices in California, Indiana and Iowa, and possibly in states without breach portals, so SecurityWeek says the total is likely well above 1.3 million. SecurityWeek had emailed Frontline for more detail and had no response when the article was published.