Frontline Education (K-12 HR and school health software): third-party product vulnerability exposes district data

What happened

• Frontline identified unauthorized activity on 14 Aug 2026 (last activity 15 Aug) linked to “a vulnerability in a third-party software product” that gave access to part of the environment supporting Frontline Central and/or School Health Management. Data varies by individual; Frontline does not publish counts or data types and says all affected districts were notified.
• Root cause: vulnerability in an unnamed third-party product used by Frontline (no CVE given).
• Attacker: not identified.
• Response: vulnerability remediated and independently validated, monitoring strengthened, law enforcement engaged, call centre, two years of TransUnion monitoring for adults and dark-web monitoring for minors. Later reporting (Oct 2026) that student SSNs and Medicaid IDs were involved was not confirmed on Frontline’s page.

Sources

• https://www.frontlineeducation.com/news/information-and-support-regarding-recent-cybersecurity-notifications
• https://konbriefing.com/en-topics/cyber-attacks-usa.html

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.