Frontline Education Confirms Student IDs in Breach

Frontline Education, a US company whose software many school districts use for staff records and school nursing, says hackers who broke into its systems in August got at Social Security numbers, Medicaid IDs and student ID numbers. In a public notice dated 26 October, the company said it had begun sending letters to the people affected. It did not say how many there are.

Frontline says its security team found on 14 August that a flaw in a third-party software product it uses had allowed unauthorised access to part of its environment, and that the last unauthorised activity was on 15 August. It has not named the product or the attacker.

In brief

Frontline says attackers used a flaw in third-party software to reach data from its Frontline Central and School Health Management products on 14 and 15 August.
The data, which varies by person, includes Social Security, driver’s licence, passport, Medicaid and student ID numbers and dates of birth.
Letters to individuals began on or about 26 October; adults get two years of credit monitoring and children get monitoring services.
Frontline has not disclosed a total number of people affected.

What Frontline says was taken

According to the notice, the affected systems were Frontline Central, which districts use to manage employee records, and School Health Management, which one South Carolina district has described as supporting its nursing services. After what it calls a “thorough and time-intensive analysis of the impacted files”, Frontline listed these data types: Social Security number, date of birth, driver’s licence number, passport number, other government ID, Medicaid ID and student ID. It stresses that the information “varies” by person.

Frontline says it fixed the flaw with an independent cybersecurity firm, told law enforcement and tightened its monitoring. Its incident page says the investigation has concluded. Adults in the US are being offered two years of TransUnion credit monitoring at no cost; minors are being offered dark-web monitoring where available. Frontline, which says it supports more than 10,000 K-12 organisations, is part of the US industrial software group Roper Technologies.

Districts have been counting their losses since October

The breach is not new to school IT staff. BleepingComputer reported on 2 October that Frontline had begun telling districts that employee data had been stolen, with notices arriving from 1 October. Districts had until 16 October to opt out of letting Frontline notify their staff.

Individual districts then went public. Farmington Public Schools in Connecticut says 2,129 of its employees had Social Security numbers, email addresses and home addresses exposed. Greenwood School District 50 in South Carolina said around 16,678 current and former students may have been affected, Fox Carolina reported on 5 October. A filing with the California Attorney General by the Kern County Superintendent of Schools, dated 14 October, includes Frontline’s template letter.

There is one inconsistency. That template says unauthorised access began on 13 August, while Frontline’s 26 October notice says it began on 14 August.

A school vendor’s breach lands on thousands of families at once

The notice confirms what districts had been piecing together for three weeks: this was not only a staff data breach. Medicaid and student ID numbers belong to children, and children’s identities are attractive to fraudsters because a stolen Social Security number can be used for years before anyone checks a credit file. That is why the offer of monitoring for minors matters, even if it is less than the credit monitoring given to adults.

The pattern is familiar. Districts buy software from a handful of vendors, so a single break-in at one supplier reaches pupils across many states, as the theft of California student data from a state testing contractor showed this month. Universities face the same problem with their own portals, as Yonsei’s hack in Seoul did. The longer the gap between break-in and notice, the longer families are exposed without knowing it: here it was more than ten weeks from discovery to the first letters to individuals, though Frontline told districts much sooner. Health data is a growing target too, as the cyber event at UNM Health showed.

What Frontline has still not said is how many people it is writing to, or which third-party product was at fault. Those numbers should start to appear in state attorney general breach filings as the letters go out.