Frontline Education Data Breach Hits 1.3M: What to Do If You Got a Letter

Updated: Nov 5, 2026

Frontline Education, which makes K–12 school administration software, is notifying more than 1.3 million school employees and students that their personal information was stolen in an August 2026 breach. That count comes from filings in five states, SecurityWeek reported on Nov. 3, 2026, and the full total is likely higher.

The exposed data varies by person but can include Social Security numbers, dates of birth, driver’s license and passport numbers, Medicaid IDs, and Student IDs, according to Frontline’s Oct. 26 notice. Frontline serves more than 10,000 K–12 organizations nationwide.

No compromise. Promise

Your credit, finances, and info, all kept Safer Than Safe.

Learn more

Did You Get a Frontline Education Breach Letter or Email?

Frontline began sending individual notices on or about Oct. 26, 2026, by email or by U.S. mail. The mailed letter’s return address reads “Frontline Education c/o Cyberscout, PO Box 1286, Dearborn, MI 48120-9998,” according to the sample letter Frontline filed with the California attorney general. Cyberscout, a TransUnion company, is handling mailings and monitoring on Frontline’s behalf. District administrators received earlier emails from frontline@notifications.cyberscout.com starting Oct. 1.

• What’s offered: Adults get 24 months of free TransUnion credit monitoring. Enroll at mytrueidentity.com with the activation code in your letter. Minors are offered free cyber monitoring.
• Deadline: Enroll by the date in your letter (Jan. 31, 2027, on the sample notice). Your code won’t work after the date in your letter.
• How to confirm it’s real: Don’t call numbers or click links in an unexpected message. Call the TransUnion call center listed in Frontline’s notice, 1-800-759-7279 (8 a.m. to 8 p.m. ET, Monday through Friday), or check with your district’s HR department or main office.
• Spanish: A Spanish version of the letter template is at frontline-transunion.com/Spanish.

What Happened in the Frontline Education Data Breach

On Aug. 14, 2026, Frontline’s security team found that a vulnerability in third-party software it uses had allowed unauthorized access to part of its environment. The last unauthorized activity was Aug. 15. Frontline says it fixed the vulnerability, investigated with an independent cybersecurity firm, and contacted law enforcement. It has not named the software or the attackers, and it says it is not aware of any misuse of the data.

The breach affected two Frontline products: Frontline Central, which districts use for employee records, and School Health Management, which school nurses use to document student health care. That is why both staff and students are getting notices. The exposed information varies by person and can include:

• Names, home addresses, and email addresses
• Social Security numbers and dates of birth
• Driver’s license numbers, passport numbers, and other government ID numbers
• Medicaid IDs
• Student IDs

Who has been notified so far:

What was exposed depends on which Frontline products a district used. Some districts report only employee data, and others report student data.

• Five states: Filings in Massachusetts, New Hampshire, South Carolina, Texas, and Vermont total 1,298,917 people, SecurityWeek reported. Frontline also filed notices in California, Indiana, and Iowa, so the full count is likely higher.
• South Carolina: The state’s breach notice registry lists 493,535 affected residents, eSecurityPlanet reported.
• Killeen ISD (Texas): About 45,000 current and former employees and others. The district said no student information was involved.
• Greenwood School District 50 (South Carolina): About 16,678 current and former students. Exposed data may include Medicaid ID numbers and contact details. [VERIFY]

Warning Signs That Your Personal Information was Compromised in a Data Breach

Because compromised Social Security numbers and contact details enable identity theft and targeted phishing, school employees and parents should watch for these specific warning indicators:

• Unsolicited verification requests: Emails or calls claiming to represent Frontline Education, Cyberscout, or district HR asking you to confirm personal details, login credentials, or your monitoring activation code.
• Targeted phishing (spear phishing): Messages addressing you by name and referencing your specific school district, job title, or administrative role.
• Unfamiliar credit inquiries: Alerts from credit monitoring services showing credit checks or new account applications that you did not initiate.
• Tax filing irregularities: Communications from the IRS or state tax authorities indicating that a tax return has already been filed using your Social Security number.
• Health coverage you didn’t use: Medicaid or health plan statements, or benefit notices, for care or services you didn’t receive.
• Activity in a child’s name: Credit offers, IRS notices, or collection calls addressed to a student.

How School Staff and Parents Can Protect Themselves

If you work or worked for a school district that uses Frontline, or your child attends or attended one, take these steps:

• Enroll in the free monitoring by the date in your letter. Adults can enroll at mytrueidentity.com with the activation code in their letter. Minors are offered free monitoring.
• Freeze your child’s credit. Parents and guardians can request a free credit freeze for children under 16 at Equifax, Experian, and TransUnion. Each bureau creates a file for the child and freezes it, which blocks new accounts in the child’s name.
• Review health coverage statements. If your letter lists a Medicaid ID, check Medicaid or health plan statements for visits, prescriptions, or services you didn’t receive.
• Freeze your credit, or place a fraud alert. A freeze has to be placed separately at Equifax, Experian, and TransUnion. A fraud alert needs only one bureau, which notifies the other two. A credit freeze prevents lenders from accessing your credit report, stopping bad actors from opening unauthorized accounts in your name.
• Verify the notice before you act. Confirm with your district’s HR department or main office that your district was affected, or call the TransUnion call center listed in Frontline’s notice. Don’t call numbers or click links in an unexpected message.
• Enable multi-factor authentication (MFA). Turn on MFA across all personal email accounts, financial portals, and school district access systems to prevent unauthorized sign-ins.
• Monitor credit reports at the source. Request free annual credit reports through the official annual credit report website to review active accounts and financial inquiries.

What to Do If You Have Already Been Targeted

If your or your child’s Social Security number or personal financial details have already been misused, complete the following recovery steps immediately:

• Stop contact with suspicious senders. Do not reply to unverified emails, texts, or phone calls requesting additional personal information.
• Notify your financial institutions. Contact your bank, credit card issuers, and payment providers to alert them of potential identity theft and place fraud holds on compromised accounts.
• Report identity theft to the federal government. File an official identity theft report at the FTC identity theft portal to receive a recovery plan and official documentation for disputing fraudulent accounts.
• Freeze your credit. If you have not yet frozen your credit, do so immediately with Equifax, Experian, and TransUnion.
• Change affected account credentials. Update passwords for primary email accounts and school portal logins. Use complex, unique passwords for every service.
• File a report with local law enforcement. If you incur financial losses or discover fraudulent accounts opened in your name, submit a police report and request a copy for your dispute records.
• Maintain detailed documentation. Retain copies of notification letters, email headers, police reports, and fraudulent transaction statements.

How to Report the Threat and Next Steps

To report suspicious activity or document fraudulent use of your information resulting from this incident, use official reporting channels:

• FBI Internet Crime Complaint Center: File cybercrime reports at the FBI Internet Crime Complaint Center.
• Federal Communications Commission: Submit complaints regarding phone scams or caller ID spoofing at the FCC complaint center.
• Federal Trade Commission: Report identity theft at FCC.gov and other fraud at ReportFraud.ftc.gov.

As of November 2026, Frontline’s notices are still going out, and new district and state counts are still being posted. If you got a letter or email, enroll in the free monitoring by the date in your letter, and freeze your credit, and your child’s, with Equifax, Experian, and TransUnion. Treat any call, text, or email about this breach that asks for your Social Security number or activation code as a scam until you confirm it through your district or the call center number in Frontline’s notice. Automated monitoring tools can alert you if your exposed information appears online.