Frontline Education, a major provider of administration software for K-12 school districts in the U.S., has confirmed a data breach that exposed Social Security numbers, government ID numbers, Medicaid IDs and student IDs tied to staff and students at school districts across the country. The company began sending notification letters on October 26, 2026, more than 2 months after attackers exploited a vulnerability in a third-party software product to reach part of its environment.
The incident affected 2 Frontline products: Frontline Central, which districts use for human resources and employee records, and School Health Management, which school nurses use to document care and handle Medicaid billing. Frontline has not said how many people or districts were affected in total.
What Frontline has confirmed
In a notice of data breach published on October 26, the Wayne, Pennsylvania company said its security team identified a vulnerability in a third-party software product on August 14, 2026. The flaw allowed unauthorized access to a portion of its environment starting that same day. Frontline said the last day of unauthorized activity was August 15, 2026.
The company said it investigated with help from an independent cybersecurity firm, fixed the vulnerability, contacted law enforcement and added new security controls. On its cybersecurity incident information page, Frontline says the investigation has concluded and that it is making required regulatory notifications.
Frontline has not named the third-party product or the vulnerability involved. It has also not said who was behind the attack, and no established ransomware group has publicly claimed it.
What data was exposed
Frontline said the information involved varies by person. According to the company, the impacted data elements include:
- Social Security numbers
- Dates of birth
- Driver’s license numbers
- Passport numbers
- Other government ID numbers
- Medicaid IDs
- Student IDs
Notices shared by school districts also list names, home addresses and email addresses. Frontline said it is not aware of any misuse of the data.
School districts report their own numbers
Because Frontline has not published a total, the clearest picture of the scale so far comes from individual districts.
Killeen Independent School District in Texas said Frontline told it that personal information connected to about 45,000 current and former employees and others may have been exposed. That data may include Social Security numbers, home addresses, dates of birth and email addresses. Killeen ISD said its own systems were not hacked and that Frontline told the district no student information was involved there. The district added that it continues to seek answers from Frontline about the scope of the incident.
Klein ISD, near Houston, is listed in a breach report filed with Texas regulators on October 16 that names 37,966 people as potentially affected, according to reports. Smaller districts have reported counts in the hundreds to low thousands of employees.
The breach also reached students. Greenville County Schools in South Carolina said the only impacted system in its case was School Health Management, used for nursing documentation and Medicaid billing. The district said Medicaid billing numbers, names, student ID numbers and birthdates were compromised, and that Frontline would contact current and former students who may have been affected.
Districts in Texas, South Carolina, Maryland, Washington and Massachusetts have disclosed the incident to staff and families, according to reports.
What affected people should do
Frontline is offering affected adults in the U.S. 2 years of free credit monitoring and identity theft protection through TransUnion. Affected minors are being offered cyber and dark web monitoring where available. Greenville County Schools said people must enroll by January 31, 2027, to receive the services.
Frontline says notices are being sent by email or U.S. mail. Anyone who receives one should:
- Follow the enrollment steps in the notice and use the TransUnion call center listed on Frontline’s incident page for questions.
- Be cautious of unexpected calls, texts or emails that ask for personal details or payment. Frontline says neither it nor TransUnion will ask people to pay for the services.
- Consider a credit freeze, especially for children whose Social Security numbers may have been exposed. Minors rarely check their credit, which makes them attractive targets for identity fraud.
- Review the FTC’s data breach guidance and report any identity theft to local police.
Another blow to K-12 data security
The Frontline incident is the latest in a series of breaches at companies that hold large amounts of school data. Earlier this year, the Instructure Canvas breach left schools across the U.S. reporting data exposure. Breaches at third-party education vendors are hard for districts to control, because a single flaw at one provider can expose records from thousands of schools at once.
Frontline has not yet said how many school districts use the affected products or how many notification letters it is sending. BreachNews will update this story if the company or state regulators release a total count.
