Frontline Education, a company that supplies administration software to schools across the United States, has told regulators that a data breach in August affected 3,085,266 people, including school district staff and students.

The figure was reported to the Indiana attorney general's office and published on 9 November. It is more than double the 1,298,917 people listed in earlier filings with regulators in Massachusetts, New Hampshire, South Carolina, Texas and Vermont, making this one of the largest education-sector breaches disclosed this year.

How the breach happened

Frontline says attackers got into part of its environment by exploiting a vulnerability in a third-party software product. The company detected the intrusion on 14 August and says the attack was fully contained the following day.

The company has not named the third-party product involved, nor the specific vulnerability that was exploited. It has also not said who was behind the attack, and no group has publicly claimed responsibility.

The hackers stole personal information belonging to school district employees and students from two of Frontline's products: Frontline Central, which handles staff management, and School Health Management, which handles student health records.

What data was exposed

The exact information taken varies from person to person. According to Frontline's breach notice, the data could include Social Security numbers, dates of birth, government-issued identity numbers, Medicaid identification numbers and student identification numbers.

That combination is particularly sensitive because it covers both adults and children. School staff records can include the identity details used for employment and payroll, while student records can include health information held in school systems.

Frontline, which is based in Malvern, Pennsylvania, notified school districts first and is mailing or emailing affected individuals directly. Affected adults in the United States are being offered two years of free credit monitoring and identity theft protection.

Why it matters for schools

The incident shows how a single weakness in software supplied by an outside vendor can ripple through hundreds of school districts. Frontline's products are used by districts to manage staff records and student health information, so a breach at the vendor can expose data belonging to people who never dealt with the company directly.

It also underlines the value of the data held by education suppliers. Unlike a retail breach, where the main risk is fraudulent card use, the theft of Social Security numbers and identity documents creates a longer-lasting risk of identity fraud, including fraud carried out years later using a child's details.

Parents and school staff who receive a notification letter from Frontline should take up the free credit monitoring on offer and consider placing a fraud alert or a credit freeze, particularly for children, whose credit files are rarely checked and can be misused without being noticed for years.