One School Software Vendor, More Than 1.3 Million People: The Frontline Education Breach by the Numbers
Frontline Education, which makes administration software for K-12 school districts, is notifying more than 1.3 million staff and students that personal data was stolen in August through a flaw in a third-party product. The numbers and the timeline.
When a school district outsources HR, staff records or student health tracking to a software provider, it also hands that provider a large share of its risk. A breach at Frontline Education, a maker of administration software built for K-12 districts, shows how far one vendor incident can travel.
The figures below come from SecurityWeek’s report on the notifications, which draws on Frontline’s incident notice and state attorney general filings.
By the numbers
- 1,298,917: people affected, according to filings with attorneys general in Massachusetts, New Hampshire, South Carolina, Texas and Vermont.
- 3 more states (California, Indiana and Iowa) also received notices, so the true total is likely well above 1.3 million. Frontline has not published an overall count.
- 2 products held the stolen data: Frontline Central and School Health Management.
- 2 groups affected: school district staff and students.
- 1 day from intrusion to containment, according to the company.
- 2 years of free credit monitoring and identity theft protection offered to affected adults; qualifying minors are offered dark web monitoring.
The timeline
- August 14: Attackers exploit a vulnerability in a third-party software product to get into Frontline’s environment.
- August 15: Frontline says the attack was fully contained. It says it fixed the security defect and strengthened its defenses.
- Since then: Frontline notified affected districts and, working with them, began notifying individuals by email or postal mail where required and where contact details were available. Filings are now appearing in state breach portals.
What may have been taken
It varies by person, but the data may include names, Social Security numbers, dates of birth, driver’s license numbers, passport and other government ID numbers, health insurance information such as Medicaid IDs, and student IDs. SecurityWeek said it had asked Frontline for more information.
The lesson outside the classroom
Two details here apply to almost any organization. First, the door was a flaw in someone else’s software inside the vendor’s environment, which means your exposure includes your vendors’ vendors. Second, the attack was contained in mid-August, but notification filings are only now appearing in state portals. Gaps like that are common, which is one more reason the data you share with providers should be limited to what they truly need.
What this means for your company
Make a list of the software providers that hold your employees’ or customers’ sensitive records, such as payroll, HR, benefits, health and scheduling systems. For each one, know what data they hold, whether they need all of it, how they will tell you about an incident and how quickly, and who on your side would handle notifications. Ask for that in writing at renewal time. If a letter does arrive, take the free monitoring, consider a credit freeze, and watch for phishing that uses the breach as a hook.
Do you know which of your vendors hold Social Security numbers or health data for your staff, and what your contracts say they must do if they are breached? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
