Frontline Education Breach Exposes Data of 1.3 Million
Frontline Education says hackers exploited a vulnerability in third-party software and accessed personal information from two products used by school districts. State filings indicate that at least 1,298,917 people were affected.
Radwan AbdulhadiEditor and technology writer
School technology provider reports breach
Frontline Education is notifying more than 1.3 million people that their personal information was compromised in a data breach. The company provides administration software designed for K-12 school districts, and the incident affected information held in its Frontline Central and School Health Management products.
According to the company’s investigation, attackers gained unauthorized access to Frontline’s environment after exploiting a vulnerability in third-party software. Frontline said it addressed the security defect and strengthened its security measures after discovering the incident.
Attack contained after one day
The breach occurred on August 14, and the attack was fully contained by August 15, Frontline said in an incident notice. The company has not publicly identified the third-party software involved or provided additional technical details about how the vulnerability was exploited.
The investigation determined that the attackers stole personal information belonging to both school district staff and students. The specific information involved varies from person to person, meaning not every affected individual necessarily had the same types of data exposed.
Types of information potentially exposed
The potentially compromised data may include names, Social Security numbers, dates of birth, driver’s license numbers, passport numbers and other government identification numbers. It may also include health insurance information, including Medicaid identification numbers, as well as student identification numbers.
The breadth of the information described in the notice creates risks that differ across the affected population. Staff members may have had employment or identity information exposed, while students may have had education, identification or health-related details included in the affected records. Frontline did not state how many people had each specific category of information involved.
State filings point to larger total
Frontline has not disclosed a single company-wide figure for the number of people affected. However, filings with the attorneys general in Massachusetts, New Hampshire, South Carolina, Texas and Vermont list 1,298,917 affected individuals.
The company also filed notices with attorneys general in California, Indiana and Iowa. Because some states do not maintain public data-breach portals, the total number of affected people may be higher than the figure reflected in the available filings. The state reports therefore indicate that the incident affected well over 1.3 million people.
Frontline said it has notified affected school districts and, working with those districts, has begun contacting individuals whose information was involved. Notifications are being sent by email or by letter through the US Postal Service, where required and where contact information is available.
Monitoring offered to affected individuals
The company is providing affected adults in the United States with two years of free credit monitoring and identity-theft protection services. For qualified minors, Frontline is offering free dark-web monitoring services.
Frontline has not shared further details about the third-party vulnerability, the attackers or whether the stolen information has been publicly released. The company’s disclosures describe the incident’s scope and support measures but do not indicate that the breach affected systems beyond the products identified in the notice.
Sources
- SecurityWeekFrontline Education Data Breach Impacts Over 1.3 Million
Continue chronologically
Related stories
Frontline Education Data Breach Exposes School District Employees
Frontline Education is notifying school districts of a data breach after a third-party software vulnerability exposed employee information.
Revolve Data Breach Exposes Data of Over 180,000 People
Online fashion retailer Revolve discloses a data breach impacting at least 180,000 individuals after hackers accessed its e-commerce platform.
Capcom Confirms Massive Data Breach Affecting 11.7 Million Users
Capcom has confirmed a data breach affecting over 11.7 million Capcom ID accounts, exposing customer email addresses and related account information.
CenterPoint Energy Data Breach Impacts Over 1 Million Texans
CenterPoint Energy confirms a data breach has impacted over 1 million Texas residents, compromising personal information such as Social Security numbers.
