Frontline Education Data Breach: 3,085,266 School Staff and Students Affected, What Is Confirmed and What Districts Should Do This Week

Frontline Education sells HR and school health software to K-12 school districts. It has told Indiana's Attorney General that its August 2026 data breach affected 3,085,266 people. If your district uses Frontline Central or School Health Management, the stolen files may have held staff and student Social Security numbers, Medicaid IDs and other identity data, and the people affected will come to you with questions first.

This post covers what Frontline has confirmed, what the Indiana filing adds, what is still unknown, and what districts, schools and any organization that keeps staff records with a cloud vendor should do this week.

What happened in the Frontline Education data breach

Frontline published its notice of data breach on October 26, 2026, and keeps a separate cybersecurity incident page. According to those two pages:

• The cause: On August 14, 2026, Frontline identified unauthorized activity linked to a vulnerability in a third-party software product it uses. The last day of unauthorized activity was August 15, 2026.
• The products involved: Frontline Central and School Health Management.
• The response: Frontline says it fixed the vulnerability, had an independent cybersecurity firm validate the fix, added security controls and monitoring, and brought in law enforcement. It says the investigation has concluded and the incident is "fully remediated."
• The notifications: Frontline notified affected districts first. Working with those districts, it then began notifying individuals on or about October 26, 2026, by email and U.S. mail where it had addresses, plus a public notice and press release.
• Misuse: Frontline says it is "not aware of any examples of data misuse as a result of the incident."

How many people the Frontline breach affected

Frontline's own pages give no count of affected people or districts. The number comes from the Indiana Attorney General's 2026 year-to-date data breach report. Its Frontline Education row reads:

That total comes from a state filing, not a figure Frontline has published itself. We have not found a public breakdown of how many records belong to staff and how many to students.

What data was exposed

Frontline says the information involved varies from person to person. Its notice lists these types:

• Social Security numbers
• Dates of birth
• Driver's license numbers
• Passport numbers and other government ID numbers
• Medicaid IDs
• Student IDs

The public notice does not say which types came from which product, or how many records include each type. Each person's letter says what was involved for them.

What is not known yet

• The third-party product. Frontline has not named the software that had the vulnerability, so other organizations cannot yet check whether they run it too.
• Which districts. Frontline has not published a list of affected districts or a count.
• Who did it. Frontline's pages do not name an attacker.
• Whether the data has been used. "Not aware of misuse" is Frontline's statement. It does not prove the data will never be used.

Why the Frontline breach matters for a district or a business

The breach happened at the vendor, but the people affected are your staff and your students. They will call the district office, not a call center in another state. Three points apply to any organization that keeps employee records with a cloud vendor, whether that is HR, payroll, scheduling or benefits software.

The gap between the attack and the letters. Frontline gives August 15 as the last day of unauthorized activity, and individual notices began on October 26: 72 days later. Do you know what your contract says about how fast a vendor must tell you, and how fast you must tell your people?

Data that outlives its purpose. Social Security numbers, passport numbers and Medicaid IDs are among the hardest identifiers to replace. Ask every vendor that holds them why it needs them, and how long it keeps records for former staff and students who have left.

Your vendor's vendors. Here the weak point was third-party software inside Frontline's own environment. A vendor security review should ask what outside software sits in front of your data, and how fast the vendor patches it.

What to do this week

Watch for the warning signs the FTC lists for child identity theft: collection calls or bills for accounts you did not open, government benefits denied because the child's number is already in use, or an IRS letter about the child's income.

Frontline Education breach questions people are asking

Was my information in the Frontline Education data breach?

Only your letter can tell you. Frontline is notifying affected people by email and mail, working with their districts. If you work at or attend a district that uses Frontline Central or School Health Management and you are unsure, ask your district office or call 1-800-759-7279.

How many people were affected by the Frontline breach?

Frontline's filing with the Indiana Attorney General lists 3,085,266 people in total, 66,157 of them Indiana residents. Frontline has not published a count on its own site.

What information was stolen in the Frontline breach?

Depending on the person, it may include Social Security numbers, dates of birth, driver's license, passport and other government ID numbers, Medicaid IDs and student IDs.

How did hackers get into Frontline Education?

Through a vulnerability in a third-party software product Frontline used. Frontline has not named the product or the attacker.

Is the call or email about the Frontline breach real?

Be careful. Frontline says it will never contact you by phone or email to ask for personal or account information. Use only the enrollment steps in your letter and the published call center number.

What should parents do if a child's data was exposed?

Enroll the child in the monitoring offer in the letter and consider freezing their credit with all three bureaus. The FTC says a parent can request a free freeze for a child under 16, and it stays in place until you ask for it to be removed.

Is Frontline safe to keep using?

Frontline says it fixed the vulnerability, had the fix validated by an independent firm and added monitoring. Districts should ask for that in writing, along with the answers to the vendor questions above, before renewing.

The bigger lesson

When you hand your people's records to a vendor, you hand over the data but not the responsibility. The questions that matter after a breach (what the vendor stores, how long it keeps it, what software guards it and how fast it will tell you) are cheaper to ask before one.

If you want help reviewing the vendors and systems that hold your staff data, see our security hardening service or request a quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: Frontline Education: Notice of Data Breach; Frontline Education: Cybersecurity Incident Information; Indiana Attorney General: 2026 Data Breach Year-to-Date Report; FTC: How To Protect Your Child From Identity Theft.