Frontline Education data breach (school software vendor): SSNs, Medicaid IDs and student IDs impacted — what staff and parents should do

Frontline says it is notifying people by email or U.S. Mail, starting on or about October 26, 2026. Its notice lists the TransUnion call center at 1-800-759-7279, 8 a.m. to 8 p.m. ET, Monday to Friday, excluding major U.S. holidays.

BleepingComputer reports that some district administrators first doubted notices sent through a third-party notification provider before others confirmed them. If unsure, open Frontline's own notice page yourself and compare, rather than using a link in the message.

Frontline says U.S. adults are offered two years of credit monitoring and identity-theft protection through TransUnion at no cost, and minors are offered cyber monitoring through TransUnion. Its incident page words this as dark-web monitoring for qualified minors where available. Enrollment instructions are in your notice.

Frontline says it and TransUnion will not ask you to pay for these services. Treat any request for payment as a scam.

A credit freeze stops lenders from opening new credit in your name. The Federal Trade Commission (FTC) says it is free to place or lift and does not affect your credit score, and you place it with each of Equifax, Experian and TransUnion.

For a child under 16, the FTC says you can request a free freeze, with a different process at each bureau. A freeze matters most here because a Social Security number is among the data elements the company says were impacted (varying by person). See also what to do when ID document data leaks.

The company says Medicaid IDs and student IDs were among the data elements impacted, varying by person. A message that quotes them, or your child's name and school, has not proved it is genuine. Frontline says it will never call or email to request personal or account information.

Do not follow the link. Call your district or your state Medicaid agency using a number from their official website. For the basics, see What is phishing?

Frontline advises reviewing account statements and credit reports for signs of fraud, and contacting local police if you suspect identity theft. The FTC's IdentityTheft.gov gives a recovery plan.

Because Medicaid IDs were among the data elements impacted for some people, also read any benefit statements for services you did not receive. The IRS offers an Identity Protection PIN to anyone with an SSN who can verify their identity, which helps block someone filing a tax return in your name.

Build a table of every service that holds student or staff identifiers: vendor, product, which items (SSN, Medicaid ID, student ID, date of birth) and why. Start with vendors that hold SSNs or health IDs, and ask whether each item is really needed. An item that is not stored cannot be exposed.

Frontline's notice says it notified districts first, and press reports describe an option for districts to opt out of the vendor handling their notifications by a set date. Decide in contracts who notifies individuals, who files with regulators, and within how many days you must be told, before an incident happens.

A vulnerability in a supplier's software is described as the way into the vendor's environment. Ask vendors how they track and patch the third-party software they run, and how quickly. For a framework, see Security baseline for organizations.

Because the impacted data includes children's identifiers, have text ready that says what the district knows, which official contacts are real, and that the district will not ask for ID numbers by phone. A clear message reduces the chance that follow-on scams succeed.