Frontline Education has told Indiana’s attorney general that a breach found in August touched 3,085,266 people, well above double the roughly 1.3 million the K-12 administration software vendor reported to several other states.
The notification says intruders got into one slice of its environment by leaning on a weakness in software from another vendor. Discovery came August 14; a day later the attack was shut down.
What was taken
Records for district employees and students were pulled from Frontline Central and from School Health Management, two of the vendor’s products. Not everyone lost the same fields. Names and student IDs may appear, as may Social Security and driver’s license numbers, birth dates, passport and other government identifiers, and Medicaid or other health insurance details.
For grown-ups the offer runs to two years of credit monitoring plus identity theft cover. Minors who qualify get dark web monitoring instead, a narrower remedy for data carrying the same long-term value.
A child’s Social Security number is durable currency, usable for years before the victim is old enough to notice. Credit monitoring should be a starting point, not the answer.
Frontline has not identified the third-party product involved and has not attributed the intrusion. No known cybercrime group has claimed responsibility.
Questions the districts should ask
Schools were told what leaked, not which suppliers were in scope, and that gap is where the next breach lives. Map every vendor touching student records, confirm each patched the flaw once named, and demand notification clauses with timelines measured in days.
The count is its own governance story. A figure that doubles mid-investigation means the first filing was an estimate, and notices get decided on estimates. One reconciled number would not have stopped the breach, but it would spare families months of ambiguity.
