Frontline Education, which sells administration software to U.S. K-12 school districts, told the Indiana Attorney General's Office that its August data breach affected 3,085,266 people, SecurityWeek reported Monday. That is more than double the roughly 1.3 million counted in the company's earlier filings with other states, and the people affected include students as well as district employees.
What Happened
The Primary Wire reported the breach in October, citing BleepingComputer, when notices described exposed Social Security numbers of district staff and Frontline had given no total. SecurityWeek reported Nov. 3 that filings in Massachusetts, New Hampshire, South Carolina, Texas and Vermont added up to about 1.3 million people.
Frontline detected the intrusion Aug. 14 and says it was fully contained the next day. The attackers reached part of its environment through a flaw in a third-party software product the company has not named. The data came from two products, Frontline Central and School Health Management.
What was exposed varies by person but can include names, Social Security numbers, birth dates, driver's license, passport and other government ID numbers, health insurance details such as Medicaid ID numbers, and student ID numbers. Frontline is offering adults two years of credit monitoring and identity protection, and eligible minors dark web monitoring, which watches criminal marketplaces for a person's data. Frontline has not said who carried out the attack, and no known cybercrime group has claimed it, according to SecurityWeek.
Why It Matters
A single vendor breach now reaches more than 3 million people, including students. Fraud using a child's identity can go unnoticed for years, until the child first applies for credit. The jump in the count also shows that early tallies drawn from a few state filings can badly understate the total.
For school districts, the steps are practical: confirm whether they use either affected product, make sure staff and families know how to sign up for the monitoring Frontline offers, and press the vendor to name the third-party product so they can check whether other suppliers rely on it.
What to Watch
- Whether Frontline names the third-party product that was exploited.
- Further state filings that could change the count.
- Scrutiny from state regulators over how student health and identity data was protected.
