TL;DR: The Frontline Education data breach hit the K-12 school software company that thousands of US school districts use for HR records and student health records. Frontline says an attacker got in through a flaw in third-party software and accessed data from Frontline Central and School Health Management on August 14–15, 2026. Depending on the person, the stolen data includes Social Security numbers, dates of birth, driver’s license and passport numbers, Medicaid IDs and student IDs. State filings put the count at at least 1.3 million people, and Frontline’s Texas filing reportedly lists 3,085,266 people in total. If you got a letter from “Frontline Education c/o Cyberscout” in Dearborn, Michigan, it’s real. Enroll in the free TransUnion monitoring with the code in your letter (by January 31, 2027 at the latest), and freeze your credit at all three bureaus.
Last updated: November 5, 2026. By Veer. Facts checked against Frontline Education’s Notice of Data Breach (October 26, 2026) and Cybersecurity Incident Information page, the sample adult notice letter filed with the California Attorney General, state attorney general filings as reported by SecurityWeek, teiss, DisclosureLens and BreachRecord, reporting by BleepingComputer, and federal court dockets compiled by OpenClassActions and Justia. This is a researched news explainer, not legal advice.
What happened in the Frontline Education data breach?
An attacker used a vulnerability in a third-party product that Frontline Education uses to get into part of its systems, and took personal data from two of its school products. In its October 26 notice, Frontline says its security team “identified a vulnerability in a third-party software product we use that allowed unauthorized access to a portion of the environment beginning on August 14, 2026,” and that “the last day of unauthorized activity was August 15.”
Frontline says it investigated with an independent cybersecurity firm, fixed the flaw, contacted law enforcement and added more monitoring. It says the investigation is complete and that it is “not aware of any examples of data misuse.” It hasn’t named the third-party software, the attacker, or whether there was a ransom demand.
Frontline Education is the trade name of Frontline Technologies Group LLC, based in Wayne, Pennsylvania, and part of Roper Technologies. It says it supports “more than 10,000 K-12 organizations nationwide.” The two affected products are:
| Frontline product | What schools use it for | Who is in the data |
|---|---|---|
| Frontline Central | Employee records: hiring, onboarding, HR files | Current and former school staff, and some job applicants |
| School Health Management | Student health records kept by school nurses | Students (Medicaid IDs and student IDs are on the list) |
Source: Frontline Education’s incident information page. Frontline says districts that used neither product were not affected.
Other Frontline tools, such as the Aesop/Absence Management substitute system, are not named in the notice. If your district only uses those, Frontline’s statement means your data wasn’t part of this incident.
Who is affected, and how many people?
Frontline hasn’t published a total, but state filings show at least 1.3 million people, and the Texas filing reportedly lists just over 3 million. Companies must report breaches to some state attorneys general, and those filings carry the numbers Frontline hasn’t put on its own website.
| State filing | Residents affected | Filed |
|---|---|---|
| Texas | 778,372 (filing reportedly lists 3,085,266 total) | October 28, 2026 |
| Indiana | 66,157 | October 26, 2026 |
| Massachusetts | 16,550 | October 2026 |
| New Hampshire | about 7,475 (staff and students) | October 26, 2026 |
| Vermont | 2,985 | October 27, 2026 |
| South Carolina, California, Iowa | Filed; no public count yet | October 2026 |
Sources: SecurityWeek (1,298,917 across Massachusetts, New Hampshire, South Carolina, Texas and Vermont), teiss (per-state figures for Massachusetts, New Hampshire, Vermont and Texas), and DisclosureLens and BreachRecord (Indiana count and the 3,085,266 total from the Texas filing). The Texas Attorney General’s breach portal itself only loads in a browser, so the 3,085,266 total comes from these two trackers’ readings of it.
Put simply, 1.3 million is the floor. That’s the sum of five states’ filings. California and Iowa have no public count, and many states don’t publish breach filings at all. If the 3,085,266 figure is right, this is one of the largest school data breaches in the US this year.
The people affected are mostly teachers and other school employees, plus some former staff and job applicants. Student data depends on the district. Waco ISD in Texas said no Waco ISD student data was exposed, while Anderson School District Two in South Carolina told parents student information may have been compromised, according to OpenClassActions, which compiled the district statements. One district notice seen by BleepingComputer said 1,210 of its employees were affected.
What information was stolen?
It varies by person, and your own letter lists exactly what was taken for you. Frontline’s notice gives the full list of possible data types:
| Data type | Why it matters |
|---|---|
| Social Security number | The most serious item. With your name and birth date, it can be used to open credit or file a fake tax return |
| Date of birth | Used to verify identity with banks and agencies |
| Driver’s license number | Can be used for fake IDs or account verification |
| Passport number and other government ID | Identity fraud and phishing that looks official |
| Medicaid ID | Medical identity theft: someone billing care to your coverage |
| Student ID | Lower risk alone, but links a child to a school and a district |
Source: Frontline Education Notice of Data Breach. District notices quoted in court filings also mention names, home addresses and email addresses.
No bank account or card numbers are on Frontline’s list. That doesn’t make this a small breach. A Social Security number can’t be changed like a card number, so the risk lasts for years.
Is the Frontline Education Cyberscout letter legit?
Yes. Frontline is sending its breach notices through Cyberscout, a TransUnion company, so a letter from “Frontline Education c/o Cyberscout” is expected. The sample adult letter Frontline filed with the California Attorney General shows the return address as:
- Frontline Education, c/o Cyberscout, PO Box 1286, Dearborn, MI 48120-9998
- Letter date: October 26, 2026 (later batches carry later dates; one plaintiff’s email notice was dated October 28)
- Enrollment site: www.mytrueidentity.com, using the unique code printed in the letter
- Questions: TransUnion call center 1-800-759-7279, 8 a.m. to 8 p.m. ET, Monday to Friday
Frontline’s notice says individual letters and emails started “on or about October 26, 2026.” Earlier, starting October 1, school districts got notices from frontline@notifications.cyberscout.com, according to BleepingComputer. Districts could opt out of Frontline sending notices on their behalf until October 16, so some people will hear from their district instead.
To check a letter or email is genuine, compare it with the official sample linked above, and call the number on Frontline’s own website rather than any number in a message you aren’t sure about. Frontline says it “will never contact you by phone or email to request your personal or account information,” and the monitoring is free. Anyone asking you to pay, or to read out your Social Security number or activation code, is a scammer. Our guide on how to check if a website is legit covers the warning signs of fake sign-up pages.
What should I do if I got a Frontline breach notice?
Enroll in the free monitoring, freeze your credit, and watch for tax and medical fraud. Here’s the order we’d follow, based on Frontline’s letter and US federal guidance:
- Enroll in TransUnion monitoring before your deadline. Go to mytrueidentity.com and enter your code. The letter says the code stops working after January 31, 2027, but it also says to enroll “within 90 days from the date of this letter.” For a letter dated October 26, 2026, 90 days is January 24, 2027, so use the earlier date in your own letter. Adults get 24 months of single-bureau credit monitoring plus fraud help from Cyberscout. Minors get cyber (dark web) monitoring.
- Freeze your credit at Equifax, Experian and TransUnion. A freeze stops new credit being opened in your name. It’s free under federal law, it doesn’t hurt your score, and you can lift it when you apply for credit. The FTC explains how on its credit freezes and fraud alerts page. Monitoring only tells you about fraud after it happens. A freeze helps prevent it.
- Get an IRS Identity Protection PIN. An IP PIN blocks anyone else from filing a federal tax return with your Social Security number. Tax season starts in January, so this is worth doing now.
- Check your child’s credit if a student’s data was involved. Children shouldn’t have credit files. The FTC’s child identity theft guide explains how to ask each bureau and how to freeze a child’s credit.
- Read your health insurance statements. If a Medicaid ID was exposed, look for care or prescriptions you didn’t get, and report them to your state Medicaid agency.
- Watch for phishing. Expect fake “Frontline,” “TransUnion” or “school district” emails and texts. Don’t click links in unexpected messages. Our guide on how to check if your email has been compromised shows how to see what else of yours has leaked.
- Report identity theft if it happens. Use IdentityTheft.gov for a recovery plan, and file a police report if a lender asks for one.
If you’re worried about how much of your data is already floating around, our guide to removing your personal information from the internet covers data broker opt-outs that cut down what scammers can find about you.
Is there a Frontline Education data breach lawsuit?
Yes. At least eight proposed class actions have been filed against Frontline Technologies Group in federal court in Philadelphia, but none has a settlement yet. All are in the US District Court for the Eastern District of Pennsylvania:
| Case | Case number | Filed |
|---|---|---|
| Brooks v. Frontline Technologies Group | 2:26-cv-07630 | October 5, 2026 |
| Shaw v. Frontline Technologies Group | 2:26-cv-07678 | October 6, 2026 |
| Steinman v. Frontline Technologies Group | 2:26-cv-07688 | October 6, 2026 |
| Grant v. Frontline Technologies Group | 2:26-cv-07706 | October 7, 2026 |
| Denuto v. Frontline Technologies Group | 2:26-cv-07820 | October 12, 2026 |
| Rezayat v. Frontline Technologies Group | 2:26-cv-07838 | October 13, 2026 |
| Smith v. Frontline Technologies Group | 2:26-cv-08263 | October 29, 2026 |
| Anderson v. Frontline Technologies Group | 2:26-cv-08348 | November 2, 2026 |
Sources: OpenClassActions case list (updated November 3, 2026) and the Justia docket for Smith.
The complaints generally claim Frontline failed to protect the data and took too long to tell people. The Anderson complaint, from a Texas teacher, says her notice came 75 days after Frontline found the access and points to a Texas law requiring notice within 60 days. It also argues two years of single-bureau monitoring isn’t enough. These are allegations. No court has ruled on them, and Frontline hadn’t filed a response in the cases we checked.
You don’t need to sign up for anything to keep your rights. If the cases are combined and later settle, people covered would get a court-approved notice explaining how to claim. Be wary of sites asking for your Social Security number to “join” a lawsuit.
Frontline Education breach timeline
| Date | What happened |
|---|---|
| August 13–14, 2026 | Unauthorized access begins (an earlier template letter filed in California said August 13; Frontline’s public notice says August 14) |
| August 14, 2026 | Frontline’s security team identifies the vulnerability |
| August 15, 2026 | Last day of unauthorized activity, per Frontline |
| October 1, 2026 | School districts start getting notices from a Cyberscout email address |
| October 2, 2026 | BleepingComputer reports the breach |
| October 5, 2026 | First class action (Brooks) filed in Philadelphia |
| October 16, 2026 | Deadline for districts to opt out of Frontline sending notices for them |
| October 26, 2026 | Frontline posts its formal notice; letters and emails to individuals begin |
| October 26–28, 2026 | Filings with California, Indiana, Iowa, New Hampshire, South Carolina, Vermont and Texas attorneys general |
| November 2, 2026 | Eighth lawsuit (Anderson) filed |
| January 24–31, 2027 | Monitoring enrollment deadline for October 26 letters (90 days, and the January 31 hard stop) |
Sources: Frontline Education notices, the California AG sample letters, BleepingComputer, and the dockets listed above.
School staff aren’t the only ones getting breach letters this fall. Travelers are hearing from airlines about the Amadeus data breach, and the steps above apply to almost any breach that exposes a Social Security number.
FAQ
What is the Frontline Education data breach?
It’s a cyberattack on Frontline Education, a K-12 school software company. An attacker used a flaw in third-party software to access data from Frontline Central and School Health Management on August 14–15, 2026. Exposed data includes Social Security numbers, birth dates, ID numbers, Medicaid IDs and student IDs.
How many people were affected by the Frontline Education breach?
Frontline hasn’t given a total. Filings in five states add up to 1,298,917 people, including 778,372 in Texas, and the Texas filing reportedly lists 3,085,266 people in total.
Is the Cyberscout letter from Frontline Education real?
Yes. Frontline uses Cyberscout, a TransUnion company, to send notices. Real letters come from Frontline Education c/o Cyberscout, PO Box 1286, Dearborn, MI, and point you to mytrueidentity.com and the call center at 1-800-759-7279.
Why did I get a Frontline letter if I never used Frontline?
Your school district did. Many districts store employee and student health records in Frontline software, so a teacher, staff member, job applicant or student can be affected without ever dealing with Frontline directly.
What is the deadline to enroll in Frontline’s free credit monitoring?
The sample letter says codes stop working after January 31, 2027, but also says to enroll within 90 days of the letter date. For an October 26, 2026 letter, that’s January 24, 2027, so use the earlier date.
Is there a Frontline Education class action settlement?
No. At least eight proposed class actions are pending in federal court in Philadelphia, but none has been certified or settled, and there’s no claim form.
Should I freeze my credit after the Frontline breach?
Yes, if your Social Security number was exposed. A credit freeze is free at Equifax, Experian and TransUnion, doesn’t affect your score, and stops new accounts being opened in your name. You can lift it whenever you need credit.
Sources
- Frontline Education, Frontline Education Notice of Data Breach (October 26, 2026)
- Frontline Education, Cybersecurity Incident Information Page
- California Attorney General, Frontline sample adult notification letter (October 26, 2026)
- SecurityWeek, Frontline Education Data Breach Impacts Over 1.3 Million
- teiss, Frontline Education data breach affected more than 800,000 people (October 29, 2026)
- DisclosureLens, Frontline Education filings and BreachRecord, Frontline Education Data Breach (October 2026)
- BleepingComputer, Frontline Education breach exposes school district employee data (October 2, 2026)
- OpenClassActions, Frontline Education data breach class action lawsuits (updated November 3, 2026); Justia, Smith v. Frontline Technologies Group docket
- FTC, Credit Freezes and Fraud Alerts and How To Protect Your Child From Identity Theft; IdentityTheft.gov
- IRS, Get an Identity Protection PIN
