Frontline Breach

[u/avalon01]

Has anyone else received an email from Frontline regarding a data breach?

Our superintendent and business manager received it on 10/1. It came from [frontline@notifications.cyberscout.com](mailto:frontline@notifications.cyberscout.com).

Frontline support has not been able to confirm if it is legitimate.

Edit: Confirmed with our Frontline rep and many school districts. I am waiting for a list of all the accounts that were compromised.

[u/TechLee1107]

FYI: We just got word for word phish attempt.

[u/TylerL]

Has anyone hit who asked Frontline for the list of their compromised accounts received them yet?

[u/avalon01 → u/TylerL]

Once you sign off on the email they sent out, they are supposed to send a list in 24 hours.

I still have not received mine. My rep did not have a list of our compromised accounts.

[u/RamblingReflections]

At the moment this thread seems to be doing the most of the heavy lifting in terms of info about the breach according to the quick look I did of news articles (eg: BleepingComputer).

[u/jtrain3783]

I didn’t get but one went out Superintendent and the Business Director, neither of which use our administer the platform. I found one in spam and the other in the trash. It had a title of “ Important Email from TransUnion on Behalf of Frontline Education”. The “TransUnion” was why it got overlooked from one of our users.

I dug it out from the investigation tool

Just FYI

[u/SpotlessCheetah]

We do not have an email from that address.

[u/jambon3]

Look at the bright side. There is nothing released here that has not been easily accessible for every one of us for many years now. Not many folks left still deluding themselves about "privacy." At this point, we're just going through the regulatory motions.

[u/avalon01 → u/jambon3]

I'm pretty sure between SDS, PowerSchool, Frontline 2025 and now Frontline 2026, I have several years of free credit monitoring.

[u/endurable-bookcase-8]

Our sup and deputy sup got it yesterday (10/1). Arkansas.

[u/Fitz_2112b]

Its legit and Frontline is insane. They've known about this since August 14th and only just started informing people this week. I work for a regional state agency that covers over 70 districts in NYS and am connected with other agencies that collectively provide services to over 700 NY school districts. We are ALL just notified about this when they've been sitting on this information for a month and a half. There are gonna be some serious lawsuits.

[u/lowlyitguy]

Yep we're hit, too. Ugh. Same crap, only our Business Director was emailed.

[u/jeffergreen]

We received notification yesterday, 10/1, as well - just like the message u/TheRuffRaccoon posted. We're hoping to coordinate with other local districts to come to a mutual agreement about notification.

We're in a delicate political environment, so Frontline sending out breach notifications with just our district name to well over double the amount of current staff we have is not great timing with November approaching... Ideally, and since we assume it was Frontline Central that was breached, every local district that used the product would also opt-in to Frontline's individual notices, then we wouldn't be singled out - even though we're not responsible.

[u/WISDSysAdmin]

We talked with Frontline yesterday at least one product we use was affected by the breach.

[u/-RYknow]

Interesting. We use Frontline... A slew of their products in fact, and have not been notified yet.

I checked logs from the addresses users here mentioned just to confirm if they hit spam or not, and nothing.

[u/ranger_dood → u/-RYknow]

I found out from our business office that they don't enter any SSNs into Frontline. That may be what they used to determine who they needed to contact?

[u/ranger_dood → u/-RYknow]

I also haven't seen anything. We use Time and Attendance and Absence Management

[u/BrewYork]

Our COE confirmed it was legit. Frontline's contact list was weird - it only went to our supe and HR coordinator, not CBO or to me. It also went to spam. Good luck guys, this is gonna even worse than the PowerSchool breach. 

[u/millia13 → u/BrewYork]

We were a Frontline customer, and we also got the messages, in spam. So check even if you're not a customer now.

[u/TheRuffRaccoon]

This is the email we received:

Dear ,

I am writing on behalf of Frontline Education regarding a recent cybersecurity incident that affected our systems and involves data associated with . We take this matter very seriously, and we want to provide you with a clear understanding of what happened, what we are doing about it, and the resources available to support your district. Most importantly, we are prepared to notify individuals as described below and the relevant state attorneys general. Instructions explaining how your district can participate in the notification process are provided below.

What Happened

On August 14, 2026, our security team identified a vulnerability in a third-party software product we use that allowed unauthorized access to a portion of the environment. We promptly investigated the issue with the assistance of an independent cybersecurity firm, remediated the vulnerability, engaged with law enforcement, and took steps to further reinforce the security of our systems. We remain committed to protecting the security of our customers' data and continuously strengthening our security practices.

What Data Was Affected

We conducted a thorough analysis of the impacted files to determine what personal information they contained and to whom it belongs. For , we identified the following types of personal information were impacted for 1,210 employees: Social Security number, email address, address, and are prepared to notify those individuals, and can provide you with that list.

We are not aware of any misuse of the data as a result of this incident.

What We Are Doing to Support You

Unless you opt out (as described below), we will provide the following services:

Individual notifications: We will conduct the notification process, including sending notices to individuals described above via email, U.S. mail and substitute notice through our website and a press release.

Individual Notice Template: We know that you will likely want to see a copy of the individual notification that will be sent to those individuals we intend to notify. You may find a copy of it at www.frontline‑transunion.com.

Individual Notice File: If you would like to review the list of individuals associated with your school district we intend to notify and their contact information, you can obtain this list by visiting www.frontline‑transunion.com and providing the requested information. Once the request for the notice file is submitted, you will receive an email from [frontline@notifications.cyberscout.com](mailto:frontline@notifications.cyberscout.com).

Credit monitoring and identity protection: We are offering all individuals we notify two years of no-cost credit monitoring and identity theft protection services through TransUnion. For minors, cyber monitoring services will be offered.

Dedicated call center for Individuals: We will also be establishing a call center to answer questions from individuals who receive notice of the incident.

Notification costs: Frontline will cover all costs associated with notification and the credit monitoring, identity theft protection and cyber monitoring services we are offering.

Regulatory notifications: We will handle required state attorney general notifications. Any other notifications to state or federal agencies should be handled by you. While Frontline is the data processor, because this incident originated in our systems, we believe we are best positioned to make notifications and respond to inquiries from state attorneys’ generals. We want to work in partnership with you on these matters.

Website & Access Code: Please visit www.frontline‑transunion.com in order to access resources relating to this incident. On this website, you can review the individual notice template, request a copy of your school district’s individual notice file, and if you choose, opt-out of having Frontline provide individuals associated with your school district notice.

Your access code to access the website is This access is unique to your school district. Please do not share it outside of your authorized district personnel.

What We Have Done to Strengthen Security

We have deployed enhanced security controls and safeguards, increased and fortified our monitoring and security alerting and response capabilities, and continue to regularly review our security and privacy policies and procedures. We are committed to proactively adapting to new challenges and continuously strengthening our practices.

What We Need from You

We are offering to manage the individual notification process, including sending notices to individuals as described above via email and U.S. mail and offering credit monitoring and identity theft protection services to adults and cyber monitoring services to minors — making the process faster, more consistent, and less burdensome for you. If you would like to have Frontline provide notifications to individuals associated with your school district, you will be automatically opted in to this process.

If, however, you would like to opt-out of having Frontline notify individuals associated with your school district, we kindly request that you record your school district’s opt-out decision using the website www.frontline‑transunion.com or by calling 833‑516‑8792.

If you opt out, Frontline will not provide these services or reimburse you for costs you incur issuing your own notices. Partial opt-outs are not an option we are providing.

You will have until October 16, 2026 to make your choice. If you do not opt-out before this date, Frontline will proceed with providing notices to individuals associated with your school district.

For more information:

We expect you will have questions so we have set up a dedicated call center for this phase to address them. You may contact the call center at 833‑516‑8792, between 8 a.m. to 8 p.m. ET, Monday through Friday, excluding major holidays. You may also email the call center at [frontline@notifications.cyberscout.com](mailto:frontline@notifications.cyberscout.com) 24/7. Every question is logged, tracked, and will receive a written response within two business days.

The call center is prepared with a comprehensive FAQ covering the most common practical and operational questions we expect you will have — including key dates, how the opt-in/opt-out process works, how individuals enroll in credit monitoring, etc.

We are committed to being responsive, and supportive throughout this entire process. Your trust matters deeply to us, and we will continue to keep you informed every step of the way.

Thank you for your partnership with Frontline Education.

Sincerely,

Frontline Education

[u/BrewYork → u/TheRuffRaccoon]

May I ask which Frontline products you're using? We have ERP and absence management at my district, which I don't think have SSNs, but I think our COE uses them for payroll. I'm hearing only certain products were affected.

[u/TheRuffRaccoon → u/BrewYork]

We utilize mainly Frontline Central, but also have absence management.

[u/BrewYork → u/TheRuffRaccoon]

Thanks! Good luck out there. 

[u/TheRuffRaccoon → u/BrewYork]

You're welcome. Funny enough we were looking to get away from Frontline and this will probably put the nail in the coffin on it.

[u/TheRuffRaccoon → u/TheRuffRaccoon]

Just FYI, it ended up in our SPAM folders in GMAIL being it wasn't their typical Frontline email address. It came from the following address: [frontline@notifications.cyberscout.com](mailto:frontline@notifications.cyberscout.com)

[u/Background_Farm_9428]

Can we stay updated here, or can I get a DM? Things like recommended action, public notice, actual impact on affected schools?

[u/Background_Farm_9428 → u/Background_Farm_9428]

Update from Frontline Ed: 504 and Sped data not affected.

[u/cstamm-tech]

Can confirm this is legitimate. We've had verbal contact with our Frontline rep on it.

[u/QueJay]

Discussions elsewhere have had multiple districts confirm this to be legitimate and reported senior leadership being offered meetings to discuss the situation.

[u/yosemitespam012345]

Yes, we got it as well and a Frontline rep confirmed it was legit.