Frontline Education discloses data breach of K-12 staff and student data
Frontline Education says a third-party software flaw exposed K-12 staff and student data, and notified people should enroll in the offered monitoring.
- Published
- Ecosystem
- Enterprise software
- Exploitation
- Yes, according to Frontline’s incident notice as reported by SecurityWeek, a vulnerability in an unnamed third-party software product was exploited
What happened
Frontline Education is notifying individuals that their personal information was compromised in a data breach, according to an incident notice from the company reported by SecurityWeek. The company says the incident occurred on August 14. It also says attackers gained unauthorized access to Frontline’s environment by exploiting a vulnerability in a third-party software product (SecurityWeek).
Frontline provides administration software for K-12 school districts. According to SecurityWeek, the company says it fixed the security defect, strengthened its security, and fully contained the attack by August 15 (SecurityWeek).
Frontline says its investigation found that personal information of school district staff and students was taken from the Frontline Central and School Health Management products (SecurityWeek). The company says the data varies by individual and may include:
- names
- Social Security numbers
- dates of birth
- driver’s license numbers
- passport and other government ID numbers
- health insurance information such as Medicaid IDs
- Student IDs
Frontline has not shared how many people were affected. SecurityWeek reports that filings with the Attorney General’s Offices in Massachusetts, New Hampshire, South Carolina, Texas and Vermont show 1,298,917 people affected. The outlet notes that Frontline also filed with California, Indiana and Iowa, and that the total is likely higher (SecurityWeek).
Not confirmed: the name of the third-party software product, the vulnerability or any CVE identifier, who carried out the attack, and the final number of affected people. SecurityWeek says it asked Frontline for more information (SecurityWeek).
Am I affected?
- School district staff and students: You may be affected if your district uses Frontline Central or School Health Management, according to Frontline’s notice as reported by SecurityWeek.
- Districts: Frontline says it has notified affected school districts (SecurityWeek).
- Individuals: Frontline says it is working with those districts to notify individuals by email or by US Postal Service letter, as required and where available (SecurityWeek).
- Users of the third-party product: Whether other organizations using the same third-party software are affected is not confirmed, because the product has not been named.
What to do now
- If you administer a district that uses Frontline Central or School Health Management, check whether Frontline has sent your district a notification. If you have not received one, contact Frontline to confirm whether your data was in scope (SecurityWeek).
- If you are an adult in the US and receive a notice, enroll in the two years of free credit monitoring and identity-theft protection that Frontline says it is providing (SecurityWeek).
- For qualified minors who receive a notice, use the free dark-web monitoring service that Frontline says it is offering (SecurityWeek).
- Watch for updates from Frontline. Details of the exploited third-party product and the final count of affected people are not confirmed.