Check Your Claims
Class Action Pulse
Legal News Data Privacy

Frontline Education data breach notices go out as at least six class actions are pending

Frontline Education says an intruder used a third-party software flaw to access Frontline Central and School Health Management data on August 14 and 15, 2026. Exposed data may include Social Security, Medicaid and student ID numbers. Notices began October 26 with two years of TransUnion monitoring. At least six class actions are pending in E.D. Pa.; there is no settlement.

By Class Action Pulse Staff Published

Reported from primary sources · Verified against official filings and settlement records.

Estimated reading time: 10 minutes.

Key facts

  • What happened: Frontline Education, a K-12 school software company, began sending data breach notices on or about October 26, 2026, after an intruder accessed part of its systems in August through a flaw in third-party software.
  • Systems involved: Frontline Central and School Health Management. Frontline says districts that did not use either product were not affected.
  • Data involved: Depending on the person, Social Security numbers, dates of birth, driver's license numbers, passport numbers, other government ID numbers, Medicaid ID numbers and student ID numbers.
  • What Frontline is offering: Two years of TransUnion credit monitoring for adults and cyber monitoring for minors, at no cost. The sample adult letter says to enroll by January 31, 2027.
  • The lawsuits: At least six proposed class actions have been filed against Frontline Technologies Group LLC in federal court in Philadelphia, starting October 5, 2026.
  • Status: No court has ruled on the claims. There is no settlement or claim form.

In this article

What Frontline says happened

Frontline Education is the business name of Frontline Technologies Group LLC, based in Wayne, Pennsylvania. It sells administration software used by school districts to manage hiring, payroll, absences, special education and student health records.

In a public notice dated October 26, 2026, Frontline said its security team identified a vulnerability on August 14, 2026, in "a third-party software product we use that allowed unauthorized access to a portion of the environment beginning on August 14, 2026." The company said the last day of unauthorized activity was August 15.

Frontline said it investigated with an independent cybersecurity firm, fixed the vulnerability, contacted law enforcement and added security measures. It said the incident has been "fully remediated" and that all of its products are operating normally.

The company has not publicly named the third-party software that was exploited. It also has not said how many school districts or individuals were affected.

What a third-party software breach means In this case, the attacker did not break in through Frontline's own code, according to the company. Frontline says the entry point was a flaw in a product made by another vendor that Frontline used. Companies remain responsible for securing the data they hold, and that responsibility is at the center of the lawsuits.

Whose information was exposed

Frontline's two affected products serve different groups of people.

  • Frontline Central is used by districts for employee records. The lawsuits describe exposed data belonging to current and former school employees and job applicants.
  • School Health Management is used for student health records. Frontline's notice lists Medicaid ID and student ID numbers among the affected data, which suggests students' information was also involved.

Frontline's notice says the information involved "varies" by person. The full list of possible data types is Social Security number, date of birth, driver's license number, passport number, other government ID, Medicaid ID and student ID. Each person's notice states which items were affected for them.

Frontline says it notified affected districts first, by email to two contacts at each district, and is now notifying individuals by email or by mail, where addresses are available. It also says it has posted "substitute notice," a legal alternative used when direct notice is not practical.

How the breach came to light

The public first learned of the incident on October 2, 2026, when BleepingComputer reported that Frontline was notifying school districts. The outlet said a reader shared a notice sent to one district. A school IT administrator separately posted a notice stating that 1,210 employees associated with that district were affected, with Social Security numbers, email addresses and physical addresses exposed.

According to BleepingComputer, some district officials received the notices on October 1 from a Cyberscout email address. Frontline told districts it would send individual notices on their behalf unless a district opted out by October 16. Cyberscout is a TransUnion company that handles breach response.

Frontline published an update for districts on October 9 and a formal notice on October 26, the same day individual notices began.

The class action lawsuits

At least six proposed class actions have been filed in the U.S. District Court for the Eastern District of Pennsylvania, where Frontline is based. According to a case list compiled by OpenClassActions, they are:

  • Brooks v. Frontline Technologies Group LLC, No. 2:26-cv-07630, filed October 5, 2026
  • Shaw v. Frontline Technologies Group LLC, No. 2:26-cv-07678, filed October 6
  • Steinman v. Frontline Technologies Group LLC, No. 2:26-cv-07688, filed October 6
  • Grant v. Frontline Technologies Group LLC, No. 2:26-cv-07706, filed October 7
  • Denuto v. Frontline Technologies Group LLC, No. 2:26-cv-07820, filed October 12
  • Rezayat v. Frontline Technologies Group LLC, No. 2:26-cv-07838, filed October 13

We reviewed the complaints in the Brooks and Rezayat cases. Both are assigned to Judge John F. Murphy. Almeida Law Group, a plaintiffs' firm, has reported that a motion to consolidate the cases was filed on October 15. We have not reviewed that motion. When several suits arise from the same breach, courts often combine them and appoint lead counsel for the plaintiffs.

What the complaints allege

Brooks. Marquitta Brooks, of West Memphis, filed the first case on October 5. Her lawyers are Edelson Lechtzin and Levi & Korsinsky. The complaint has five counts and seeks to represent people affected by the breach.

Rezayat. Camellia Rezayat is a current employee of the Glendale Unified School District in California, represented by Ahdoot & Wolfson. Her complaint says the district told staff in an October 6 email that Frontline's data security was "compromised on August 14, 2026," that the intrusion was "halted by August 15, 2026," and that personnel data "across multiple school districts nationwide" was affected. That email said the data "may have included Social Security numbers, home addresses, and email addresses."

The Rezayat complaint alleges Frontline should have found and patched the vulnerability sooner, segmented its systems, encrypted the data and supervised its vendors more closely. It also criticizes the gap between August 14 and the start of individual notices. It proposes a nationwide class of "all individuals whose Private Information was accessed and/or acquired by an unauthorized party in the Data Breach," plus a California subclass, and estimates the class could include hundreds of thousands of people.

The Rezayat complaint brings five counts: negligence, breach of third-party beneficiary contract, unjust enrichment, breach of implied contract and violation of the California Consumer Privacy Act. The CCPA claim is limited to California residents.

These are allegations The complaints describe what the plaintiffs believe they can prove. Frontline has not filed a response in the cases we reviewed, and no court has found that the company was negligent or broke any law.

Timeline

Date Event
August 14, 2026 Frontline identifies the vulnerability; unauthorized access begins, per Frontline
August 15, 2026 Last day of unauthorized activity, per Frontline
October 1, 2026 Districts begin receiving notices, per BleepingComputer
October 2, 2026 BleepingComputer reports the breach
October 5, 2026 First lawsuit, Brooks, filed in Philadelphia federal court
October 6 to 13, 2026 Five more suits filed, per OpenClassActions
October 16, 2026 District opt-out deadline for Frontline-run notifications, per BleepingComputer
October 26, 2026 Frontline publishes its formal notice; individual notices begin
January 31, 2027 Enrollment deadline stated in the sample adult notice

What to do if you got a notice

Read your letter or email carefully. It lists the data types that were affected for you and includes an activation code for the free monitoring.

  • Enroll in monitoring. The sample adult letter filed with the California Attorney General directs adults to mytrueidentity.com and says the code works only until January 31, 2027. The same letter also says to enroll within 90 days of the letter date, so use the earlier of the two dates in your own letter.
  • Call with questions. The TransUnion call center Frontline set up is 1-800-759-7279, 8 a.m. to 8 p.m. Eastern, Monday through Friday.
  • Consider a credit freeze. A freeze is free and blocks new credit in your name. It is especially useful if your Social Security number was exposed.
  • Check your child's credit. If a child's information was involved, you can ask the credit bureaus whether a file exists in their name.

Watch for scams Fraudsters often follow breach news with fake notices. Frontline says notices come from TransUnion on its behalf. Do not give a code, Social Security number or payment details to anyone who contacts you first and asks for them.

You do not need to join a lawsuit to keep your rights. If the cases settle, a court-approved notice would explain how to make a claim. Our Frontline Education data breach lawsuit page tracks the case, and our list of class action cases you can join shows other open cases.

What remains unresolved

  • The scale. Frontline has not disclosed how many districts, employees or students were affected.
  • The third-party product. The software vendor whose flaw was exploited has not been named.
  • Consolidation. It is not yet known whether the court will combine the cases or who will lead them.
  • Frontline's legal response. We have not seen a filed answer or motion to dismiss.
  • Misuse of the data. The company has not said whether any stolen data has been published or misused.

This article is for information only and is not legal advice. The allegations have not been proven.

What happens next

The court is likely to decide first whether to consolidate the cases and appoint interim lead counsel. A consolidated complaint would usually follow, and Frontline would then respond. Data breach class actions often settle, but that can take a year or more. We will update this story as the case develops.

Frequently asked questions

What happened in the Frontline Education data breach?

Frontline says an intruder used a flaw in third-party software to access part of its systems on August 14 and 15, 2026, affecting data in Frontline Central and School Health Management.

What information was exposed?

Depending on the person, Social Security numbers, birth dates, driver's license and passport numbers, other government IDs, Medicaid IDs and student IDs.

How do I know if I was affected?

Frontline began emailing and mailing notices on or about October 26, 2026. Your school district may also have notified staff, and you can call 1-800-759-7279.

Is there a Frontline Education class action settlement?

No. At least six proposed class actions are pending in federal court in Philadelphia, but there is no settlement or claim process yet.

Do I need to sign up for a lawsuit?

No. If a settlement is reached, affected people would receive a notice explaining how to file a claim.

What is the deadline to enroll in credit monitoring?

The sample adult letter says January 31, 2027, but also says to enroll within 90 days of the letter date. Check the date in your own notice.

Do you qualify?

See the full eligibility breakdown and check whether you can file a claim

Sources

Class Action Pulse is a news and information service, not a law firm, and this article is general information — not legal advice. Eligibility, deadlines, and payouts are set by each settlement's official administrator and the courts; always verify the details through the official source before you file.