# Frontline Education breach exposed K-12 student and staff data, including SSNs and Medicaid IDs · pwn.watch > Frontline Education, a US maker of K-12 administration software, says an attacker used a vulnerability in a third-party software product it uses to access part of its environment on Aug 14-15, 2026. Files tied to its Frontline Central and School Health Management products were affected. Depending on the person, the exposed data includes Social Security numbers, dates of birth, driver's license and passport numbers, other government IDs, Medicaid IDs and student IDs. Frontline has notified affected school districts and began mailing and emailing individual notices on or about Oct 26, 2026, with TransUnion credit monitoring for adults and cyber monitoring for minors. Page: https://pwn.watch/i/frontline-education-k12-data-breach-oct-2026 · generated 2026-10-30T05:37:51.190Z ## Status - Severity: medium · status: live · patch: partial - Product: Frontline Education (Frontline Central, School Health Management) - Started: 2026-08-14 - Affected: People whose records were in Frontline Central or School Health Management files accessed on Aug 14-15, 2026 - Fixed in: Frontline says it remediated the third-party vulnerability; individual notifications started on or about Oct 26, 2026 (enroll in TransUnion monitoring by Jan 31, 2027) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/frontline-education-k12-data-breach-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/frontline-education-k12-data-breach-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/frontline-education-k12-data-breach-oct-2026.json - This file: https://pwn.watch/i/frontline-education-k12-data-breach-oct-2026/llms.txt ## Updates (newest first) - 2026-10-26: Frontline announces it has begun sending notification letters and emails to affected individuals, listing SSNs, dates of birth, driver's license, passport and other government IDs, Medicaid IDs and student IDs among the impacted data. (https://www.frontlineeducation.com/news/frontline-education-notice-of-data-breach/) - 2026-08-14: Frontline's security team identifies unauthorized access through a vulnerability in a third-party software product; the last day of unauthorized activity is Aug 15. (https://www.frontlineeducation.com/cybersecurity-incident-information/) ## Fix brief # Security brief: Frontline Education breach exposed K-12 student and staff data, including SSNs and Medicaid IDs Source: https://pwn.watch/i/frontline-education-k12-data-breach-oct-2026 · status: live · severity: medium · updated Oct 30, 2026, 03:19 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Frontline Education, a US maker of K-12 administration software, says an attacker used a vulnerability in a third-party software product it uses to access part of its environment on Aug 14-15, 2026. Files tied to its Frontline Central and School Health Management products were affected. Depending on the person, the exposed data includes Social Security numbers, dates of birth, driver's license and passport numbers, other government IDs, Medicaid IDs and student IDs. Frontline has notified affected school districts and began mailing and emailing individual notices on or about Oct 26, 2026, with TransUnion credit monitoring for adults and cyber monitoring for minors. Severity detail: Sensitive identity data (SSNs, government IDs, Medicaid IDs) for students and staff across many US school districts; total number of affected people not disclosed - Product: Frontline Education (Frontline Central, School Health Management) ## Affected versions - People whose records were in Frontline Central or School Health Management files accessed on Aug 14-15, 2026 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Frontline says it remediated the third-party vulnerability; individual notifications started on or about Oct 26, 2026 (enroll in TransUnion monitoring by Jan 31, 2027) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes There is nothing to patch. If you or your child got a Frontline notice, enroll in the TransUnion monitoring it offers before Jan 31, 2027, consider a credit freeze for exposed SSNs (including for minors), and watch for phishing that mentions your school district or Frontline. School districts using Frontline Central or School Health Management should check Frontline's incident page and their district notification. ## Latest updates - Oct 26, 2026: Frontline announces it has begun sending notification letters and emails to affected individuals, listing SSNs, dates of birth, driver's license, passport and other government IDs, Medicaid IDs and student IDs among the impacted data. - Aug 14, 2026: Frontline's security team identifies unauthorized access through a vulnerability in a third-party software product; the last day of unauthorized activity is Aug 15. ## Advisories - [Frontline Education Notice of Data Breach](https://www.frontlineeducation.com/news/frontline-education-notice-of-data-breach/) (Frontline Education) - [Cybersecurity Incident Information](https://www.frontlineeducation.com/cybersecurity-incident-information/) (Frontline Education) - [Frontline Cybersecurity Incident Notification](https://greenville.k12.sc.us/News/main.asp?titleid=2610frontline) (Greenville County Schools) ## Write-ups & news - [Frontline Education Notice of Data Breach](https://www.businesswire.com/news/home/20261026104734/en/Frontline-Education-Notice-of-Data-Breach) --- Machine-readable: https://pwn.watch/i/frontline-education-k12-data-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.