A data breach at Frontline Education, a US school software provider, affected 3,085,266 people, according to the Indiana Attorney General’s official breach register. The filing includes 66,157 Indiana residents. The figure has drawn fresh attention on November 9, 2026, although the security incident itself happened in August.
In its October 26 breach disclosure, Frontline said it discovered unauthorized access on August 14, 2026. The company traced the issue to a vulnerability in a third-party software product it used and said the last day of unauthorized activity was August 15. The affected systems involved Frontline Central and School Health Management, two services used in K–12 school operations.
Frontline said it worked with an independent cybersecurity firm, fixed the vulnerability, informed law enforcement, and strengthened its security monitoring. The company also reported that its investigators had not seen further unauthorized activity since August 15. These findings describe Frontline’s response to the incident, but they do not eliminate the risks associated with personal information that may have been exposed.
The information involved differed from person to person. It may have included Social Security numbers, dates of birth, driver’s license numbers, passport numbers, other government identification numbers, Medicaid IDs, and student IDs. This does not mean every affected person had all these details exposed. The public state filing also does not provide a breakdown showing how many affected individuals were students, school employees, or other people.
The incident matters beyond Frontline’s own systems because schools depend on outside software providers to manage important information. For example, Sherman Independent School District confirmed that some current and former employees were affected, although the district’s own network was not breached. This shows how a security problem at a shared technology provider can affect people connected to schools without attackers directly entering each school’s systems.
Frontline began sending email and mailed notifications around October 26. These notices explain which types of personal information were affected for each recipient. Through its official cybersecurity incident information page, the company says eligible adults can receive two years of free TransUnion credit monitoring and identity-theft protection. Eligible minors are being offered dark-web monitoring where available.
Frontline says it is not aware of any cases in which information from this incident has been misused. However, its public disclosures do not identify the attacker or name the third-party software product that contained the vulnerability. The absence of known misuse is reassuring, but it does not guarantee that exposed information cannot be used in future fraud attempts.
People who receive a breach notification should verify it through their school or Frontline’s official website, follow the provided enrollment instructions, and monitor financial accounts for unusual activity. The US Federal Trade Commission explains how credit freezes and fraud alerts can help reduce identity-theft risks. Parents concerned about a child’s personal information can also review the FTC’s child identity-theft guidance, which explains free credit freezes for children under 16.
Unexpected messages offering help with the breach also deserve caution. Frontline says it will not contact people by phone or email to request personal or account information, although TransUnion may send enrollment information on its behalf. TechBonafide’s guide to recognizing fake support accounts explains how to check suspicious contacts before sharing sensitive details.
For school technology teams, the incident highlights the importance of reviewing third-party software security, data access, monitoring, and breach-response procedures. TechBonafide’s guide to connected-app and third-party security risks explores related software security concerns. However, Frontline has not publicly identified an API or particular integration as the entry point in this incident. The newly highlighted scale makes this an important update to an existing breach, not evidence of a new cyberattack.
