Frontline Education Data Breach Impacts Over 1.3 Million
Hackers exploited a flaw in third-party software and stole the personal information of school district staff and students.
Frontline Education is notifying over 1.3 million people that their personal information was compromised in a data breach.
The incident occurred on August 14 and involved the exploitation of a vulnerability in a third-party software product to gain unauthorized access to Frontline’s environment.
Frontline, which provides administration software purpose-built for K-12 school districts, addressed the security defect and reinforced security. The attack was fully contained by August 15, the company says in an incident notice.
The investigation into the data breach determined that the hackers stole the personal information of both school district staff and students from the Frontline Central and School Health Management products.
While the stolen data varies by individual, it may include names, Social Security numbers, dates of birth, driver’s license numbers, passport and other government ID numbers, health insurance information such as Medicaid IDs, and Student IDs.
“Frontline has notified affected school districts and, in cooperation with those districts, has begun notifying individuals whose personal information was affected via email or by letter sent via the US Postal Service, as required and where available,” the company says.
While Frontline has not shared the number of potentially affected individuals, filings with the Attorney General’s Offices in Massachusetts, New Hampshire, South Carolina, Texas, and Vermont show that 1,298,917 people were affected.
However, the company also filed notices with the AGOs in California, Indiana, and Iowa, and possibly in other states that do not maintain data breach portals, and the total number of affected individuals is likely well above 1.3 million.
Frontline is providing the affected US adults with two years of free credit monitoring and identity-theft protection services. For qualified minors, it offers free dark-web monitoring services.
SecurityWeek has emailed Frontline for additional information on the data breach and will update this article if the company responds.
