Frontline Education (2 Oct): third-party software vuln → school-district employee data (SSNs); districts notified
BleepingComputer (2 October 2026) reports Frontline Education — US edtech administration/workforce software used by school districts — is notifying districts of a data breach after attackers exploited a vulnerability in a third-party software product Frontline uses. Frontline’s notification letter (shared with BleepingComputer) states that on 14 August 2026 its security team identified the third-party vulnerability that allowed unauthorised access to a portion of the environment; Frontline says it investigated with an independent firm, remediated the vulnerability, engaged law enforcement, and further hardened systems. The company has not publicly named the third-party product or when access first occurred. Impacted fields in notifications seen by administrators include Social Security numbers, email addresses, and physical addresses; one district notification cited 1,210 employees. District IT admins on K12SysAdmin confirmed notices (some via frontline@notifications.cyberscout.com on 1 Oct). Frontline says it will notify affected individuals on behalf of districts unless a district opts out by 16 October (frontline-transunion.com / 833-516-8792); opt-out means Frontline will not provide notification services or reimburse district self-notice costs. Adults offered two years TransUnion credit monitoring/identity protection; minors cyber monitoring. Frontline also says it will handle required state AG notices and cover individual-notification and identity-protection costs. Total districts/individuals not yet public. No AU org named. Primary: BleepingComputer 2 Oct (notification letter quotes).
- Product
- Frontline Education edtech / workforce administration platform (third-party dependency unnamed)
- Versions
- n/a — SaaS/vendor environment; third-party product not disclosed
- Exploited in Australia?
- unknown
- Patch to
- No public CVE. AU / education operators using Frontline or similar SaaS: treat vendor third-party dependency breaches as your NDB/APP 11 assessment trigger if Australian personal information is held; demand named component, access window, and IoCs. Districts (US): confirm notice authenticity with Frontline rep; decide opt-out vs Frontline/TransUnion notification by 16 Oct; assume SSN exposure for credential/identity hygiene.
Primary: BleepingComputer — Frontline Education breach exposes school district employee data (2 Oct 2026) · Vendor: Frontline Education (vendor site; no dedicated public breach page located this pass)