Third-Party Flaw Gave Attackers Access to School Records
Frontline Education, which provides workforce management software to school districts, is notifying clients that attackers exploited a vulnerability in third-party software to access employee information. The company identified the flaw on August 14 and engaged an independent cybersecurity firm, remediated the issue and notified law enforcement. Exposed data includes Social Security numbers, email addresses and physical addresses. School districts began receiving notifications on October 1. Frontline will handle individual notifications unless districts opt out by October 16.
What Happened and When
Frontline Education's security team identified a vulnerability in a third-party software product on August 14. The flaw allowed unauthorized access to part of the company's environment. Frontline engaged an independent cybersecurity firm, remediated the vulnerability, notified law enforcement and reinforced system security.
School districts began receiving breach notifications on October 1. One district was told that 1,210 employees were affected. Administrators posting in the K12SysAdmin subreddit confirmed the communications were legitimate after speaking with Frontline representatives. The company has not disclosed when the unauthorized access first occurred.
Vulnerable Product Not Named
Frontline has not disclosed which third-party software contained the vulnerability or when attackers first gained access. The company stated only that the flaw was identified in mid-August and has since been patched.
What Information Was Exposed
Exposed data includes Social Security numbers, email addresses and physical addresses. According to letters shared with BleepingComputer, all employees at one district were affected. Another district notification stated that 1,210 employees had their information exposed.
Frontline has not disclosed how many school districts or total individuals were affected.
Notification Process and District Options
Frontline will send individual breach notices to affected employees on behalf of school districts by default. Districts that prefer to manage their own communications must opt out by October 16 through the company's portal or by calling 833-516-8792.
Districts that opt out will not receive Frontline's notification services or reimbursement for the cost of sending their own letters. Frontline says it will cover the cost of individual notifications, identity protection services and filings with state attorneys general.
Monitoring and Protection Offered
Affected adults will receive two years of credit monitoring and identity theft protection through TransUnion. Minors will be offered cyber monitoring services. Frontline will handle required notifications to state attorneys general.
The company will cover costs associated with individual notifications and identity protection services.
Steps for Affected Employees
Enroll in the free monitoring service when you receive notification. Consider placing a credit freeze at all three major credit bureaus to prevent new accounts being opened in your name.
Monitor bank and retirement account statements for unfamiliar activity. File your annual tax return as early as possible to reduce the window for a fraudulent filing in your name.
- Enroll in the free monitoring service using the code provided
- Consider placing a credit freeze at Equifax, Experian and TransUnion
- Monitor bank and retirement account statements regularly
- File your tax return early to prevent fraudulent filings
Questions readers ask
Which third-party software was exploited in the Frontline Education breach?
Frontline Education has not disclosed the name of the third-party product that contained the vulnerability. The company stated only that the flaw was identified on August 14 and has since been remediated.
How many school districts or employees were affected?
Frontline has not published a total. One district notification stated that 1,210 employees were affected. Administrators at multiple districts reported receiving breach letters. The total number of impacted districts and individuals is unknown.
What information was exposed in the breach?
Exposed data includes Social Security numbers, email addresses and physical addresses. These fields appeared in notifications sent to at least two school districts.
Can school districts opt out of Frontline's notification process?
Districts can opt out by October 16 through the company portal or by calling 833-516-8792. Districts that opt out will not receive Frontline's notification services or reimbursement for the cost of sending their own breach letters.
What protection is Frontline offering to affected individuals?
Affected adults will receive two years of credit monitoring and identity theft protection through TransUnion. Minors will be offered cyber monitoring services. Frontline will cover the costs of these services.
Source and reporting limits
Based on reporting by BleepingComputer. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.