Frontline Education data breach lawsuit (Brooks v. Frontline Technologies Group)

Frontline Education, a company that sells administration software to K-12 school districts, began mailing and emailing data breach notices on or about October 26, 2026. It says an outsider got into part of its systems on August 14 and 15, 2026, through a flaw in a third-party software product. The exposed records vary by person but can include Social Security numbers, dates of birth, driver's license and passport numbers, Medicaid IDs and student IDs.

At least six proposed class actions were filed in October 2026 in federal court in Philadelphia. The first is Brooks v. Frontline Technologies Group LLC, No. 2:26-cv-07630, in the U.S. District Court for the Eastern District of Pennsylvania. No court has ruled on the claims, no class has been certified and there is no settlement. This page explains what Frontline has confirmed, what the lawsuits claim and what school employees, applicants, students and families can do now.

The defendant is Frontline Technologies Group LLC, which does business as Frontline Education. Its headquarters is in Wayne, Pennsylvania. Frontline says it supports more than 10,000 K-12 organizations with software for human capital management, student solutions and business operations, and that it is part of Roper Technologies. The two products tied to this incident are Frontline Central and School Health Management, according to Frontline's support page.

The first plaintiff is Marquitta Brooks of West Memphis, Arkansas. Her complaint says her job required her to use Frontline software and give it her personal information. Her lawyers are Edelson Lechtzin LLP and Levi & Korsinsky LLP. Later plaintiffs include Camellia Rezayat, who says she works for the Glendale Unified School District in California, and Beth Denuto, a New Jersey educator who says she retired after 27 years. Other suits were brought by people who say they once worked for Frontline itself.

Schools are not defendants. They are Frontline's customers, and Frontline says it notified affected districts first.

These dates come from Frontline's own notices unless noted.

• August 14, 2026: Frontline's security team identified a vulnerability in a third-party software product that allowed unauthorized access to part of its environment. Access began that day.
• August 15, 2026: the last day of unauthorized activity, according to Frontline's notice of data breach.
• Early October 2026: Frontline notified affected school districts by email, and districts began alerting staff. A Glendale Unified email to staff around October 6, quoted in the Rezayat complaint, said Frontline's data security was "compromised on August 14, 2026" and the intrusion was "halted by August 15, 2026."
• October 5 to 13, 2026: six proposed class actions were filed in the Eastern District of Pennsylvania, according to court records and the complaints Class Action Pulse reviewed.
• October 15, 2026: a motion to consolidate the cases was filed in the lead Brooks case, according to Law.com.
• On or about October 26, 2026: Frontline began sending notices to individuals by email or U.S. mail and posted a public notice.

Frontline has not published a total number of affected people. A filing with the California Attorney General lists breach dates of August 14 and 15, 2026, California requires that filing when a breach notice goes to more than 500 state residents. The Rezayat complaint estimates the total is "likely hundreds of thousands," but says that on information and belief. Law.com reports Frontline serves 4.1 million daily users. That is a user figure, not a count of affected people.

The plaintiffs say Frontline held sensitive information about school workers and students and did not protect it. Their complaints say the company:

• failed to use reasonable security, including encryption and vendor oversight;
• kept data longer than needed;
• did not notify affected people quickly enough; and
• left people at long-term risk of identity theft because Social Security numbers cannot easily be changed.

The Brooks complaint brings claims for negligence, negligence per se, unjust enrichment, breach of implied contract and breach of confidence. The Rezayat complaint adds a claim that employees were intended beneficiaries of Frontline's contracts with districts, plus a claim under the California Consumer Privacy Act for a California subclass. These are accusations, not findings.

Frontline says it promptly investigated with an independent cybersecurity firm, fixed the vulnerability, contacted law enforcement and added security controls. Its notice says it is "not aware of any examples of data misuse as a result of the incident," and its support page says all products are operating normally. Class Action Pulse found no court filing in which Frontline has answered the lawsuits.

The court has decided nothing about the merits. The Brooks case is assigned to Judge John F. Murphy, according to the court docket. The Rezayat case carries the same judge's initials, while the Shaw and Steinman complaints carry a different judge's initials, so the cases are currently split. A request to combine them has been filed, and the court has not ruled on it in the records Class Action Pulse reviewed.

No judge has found that Frontline was careless or that anyone was harmed. No class has been certified.

The complaints propose broad classes. Brooks seeks to represent all persons in the United States whose private information was compromised in the breach. Rezayat proposes a similar nationwide class plus a California subclass. The usual exclusions apply, including Frontline, its officers and the judges on the case.

In practical terms, the people most likely to be covered are those whose data sat in Frontline Central or School Health Management through their school district. Frontline's support page says that includes staff and, in some districts, students. Districts that never used those two products were not affected, and Frontline says all affected districts have been notified.

The best evidence is a notice from frontline@notifications.cyberscout.com or no-reply@support.frontlineed.com, or a letter from Frontline. Frontline says those senders are legitimate.

• Read your notice carefully. It lists the types of information tied to your district.
• Enroll in the free TransUnion services using the code in your notice. California's sample letter says adults must enroll within 90 days of the letter date at mytrueidentity.com.
• Call the TransUnion call center at 1-800-759-7279, 8 a.m. to 8 p.m. Eastern, Monday through Friday, with questions.
• Consider a free credit freeze with Equifax, Experian and TransUnion. Parents can also request freezes for children.
• Ask the IRS for an Identity Protection PIN if your Social Security number was involved.
• Keep your notice, and records of any fraud, time spent or costs.

Frontline is offering two years of TransUnion credit monitoring and identity protection to adults at no cost, and dark web monitoring for minors where available. That offer comes from the company, not from a lawsuit.

The complaints ask for damages, statutory damages where the law allows, restitution and court orders requiring better security, encryption and deletion of old data. Those are requests. Any payment would require a court approved settlement or a win at trial.

• August 14 to 15, 2026: period of unauthorized access, according to Frontline.
• October 5, 2026: Brooks v. Frontline filed.
• October 15, 2026: motion to consolidate filed, according to Law.com.
• About October 26, 2026: individual notices began.
• 90 days from your letter date: enrollment window for TransUnion monitoring, per the California sample letter.

There is no claim deadline because there is no settlement. Time limits for data breach claims depend on state law.

• Proposed class action: a lawsuit filed for a group that a judge has not yet approved as a class.
• Consolidation: combining similar cases before one judge so they move forward together.
• Negligence per se: a claim that a company was careless because it broke a law meant to protect people like the plaintiff.
• Third-party beneficiary: a person a contract was meant to benefit even though they did not sign it.
• Credit freeze: a free block that stops new credit from being opened in your name.

The court will likely decide whether to consolidate the cases and appoint lead lawyers. A combined complaint could follow, and Frontline would then respond, often with a motion to dismiss. Notices are still arriving, and more state regulator filings may reveal how many people were affected. Class Action Pulse will update this page when the court acts or Frontline releases a total.

Incident facts come from Frontline's public notice and support page and the California Attorney General listing and sample letter. Lawsuit facts come from the Brooks, Rezayat and Denuto complaints and court docket records. The consolidation motion comes from Law.com, and the daily user figure is Law.com's. The affected total is not public, and the "hundreds of thousands" estimate is the plaintiff's. Class Action Pulse did not review every complaint filed.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.