Frontline Education is telling U.S. school districts that attackers exploited a vulnerability in a third-party software product and stole employee information, including Social Security numbers. A district notice reviewed by BleepingComputer (Oct 2, 2026) says Frontline’s security team identified the vulnerability on August 14, 2026, remediating with outside forensics and law enforcement. One district’s letter cited 1,210 employees impacted locally; nationwide totals remain unpublished — BreachHistory catalogs recordsAffected 0 until a full census appears.
Canonical: https://breachhistory.com/frontline-education/frontline-education2026.
What happened
Frontline provides workforce and admin software widely used by K-12 districts. The company notice describes unauthorized access to a portion of its environment via a third-party app flaw. It has not named the vendor product or the first-access date. District IT admins on r/k12sysadmin independently confirmed legitimacy after Cyberscout-branded emails raised skepticism.
Timeline
- Aug 14, 2026 — Vulnerability/unauthorized access identified.
- ~Oct 1 — District officials begin receiving notices.
- Oct 2 — BC publishes; districts can opt out of Frontline-handled individual notices by Oct 16.
Data exposed
- Social Security numbers
- Email addresses
- Physical addresses
Adults offered two years TransUnion/Cyberscout monitoring; minors get cyber monitoring. Frontline says it will notify individuals unless districts opt out via frontline-transunion.com or 833-516-8792.
Action items
- District staff: freeze credit if SSN listed.
- Enroll using letter codes only.
- Ignore fake “Frontline breach” SMS.
- IT leaders: confirm with your Frontline rep; decide opt-out by Oct 16.
Sources
Open questions and verification posture
Week-one reporting rarely includes full malware forensics. Separate victim/regulator facts from actor marketing. Missing headcounts stay zero in the catalog until a filing appears. That discipline keeps BreachHistory usable when headlines inflate.
Phishing to expect
Lookalike domains, fake incident-response WhatsApp accounts, and urgency around fake enrollment deadlines. Call numbers printed on official letters only. Do not install remote-support tools from cold callers. Do not pay crypto to strangers.
Neighboring incidents
Cross-read related BreachHistory finance, education, healthcare, and ransomware-claim posts for pattern recognition — shared vendor risk and delayed consumer mailings recur through 2026. Use comparisons for briefings, not to copy unverified counts across rows.
Security-team checklist
- Inventory non-core systems holding identifiers.
- Phishing-resistant MFA on those systems.
- Log/alert bulk exports.
- Pre-draft counsel-approved notices.
- Tabletop a 72-hour extortion email with legal and PR.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.
Readers should treat primary notices and reputable press as the source of truth, bookmark the canonical BreachHistory URL for updates, freeze credit when SSNs or national IDs are in scope, and ignore cryptocurrency “deletion” scams. Security teams should inventory non-core tools that still hold identity data, enforce phishing-resistant MFA, alert on bulk exports, and pre-draft customer notices. Journalists must label unverified leak-site claims clearly and avoid Breachsense. Household members should be briefed so secondary phishing aimed at relatives fails. When regulators revise censuses, return to the canonical link rather than viral screenshots.