# Frontline Education Data Breach via Third-Party Software Vulnerability Impacts Over 1.3 Million People

> Unidentified attackers exploited a vulnerability in an undisclosed third-party software product used by Frontline Education (K-12 school administration software) and gained unauthorized access to a portion of its environment on August 14-15, 2026. State Attorney General filings confirm 1,298,917 affected people, with additional filings suggesting the total exceeds 1.3 million.

- **Published:** 2026-11-03T15:02:06Z
- **Last reviewed:** 2026-11-03T15:02:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5157
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5157.png
- **ID:** TL-2026-5157
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 14 (2 shown free below)

## Description

On August 14, 2026, Frontline Education's security team identified a vulnerability in a third-party software product it uses that allowed unauthorized access to a portion of its environment. KXAN's report on Austin ISD quotes Frontline describing the product as one "it used to build, test and manage software", but the product, vulnerability type and any CVE remain undisclosed. The last day of unauthorized activity was August 15, 2026. The affected environment held data for the Frontline Central and School Health Management products. Frontline serves K-12 organizations (public districts, charter networks and private school systems) and reports supporting more than 10,000 K-12 organizations; its software covers human capital management, business operations and special education. Frontline stated it investigated with an independent cybersecurity firm, remediated the vulnerability, engaged law enforcement and implemented additional safeguards, and that it was not aware of any misuse of the data.

No threat actor, ransomware or extortion claim, malware or post-exploitation tooling has been publicly identified in any source reviewed. Mapping to MITRE ATT&CK is therefore limited: T1190 (Exploit Public-Facing Application) matches the reported initial access vector of exploiting a vulnerable third-party application. The Collection, Exfiltration and Phishing mappings are inferred from the fact that personal data was accessed (Rescana suggests T1041 or T1030 for exfiltration) and from the downstream risk of notification-themed phishing; they are not confirmed by the primary reporting. No network IOCs (attacker IPs, domains, hashes) have been published, so BeaconBeagle correlation was not applicable.

District notifications began around October 1, 2026 and public reporting began around October 2, 2026 when the notice surfaced on Reddit. Exposed data varies by individual and district. Reported data types include names, Social Security numbers, dates of birth, driver's license, passport and government ID numbers, health insurance information, Medicaid IDs, student IDs, email addresses and physical addresses. Victims are school district employees and students. One reproduced notice cites 1,210 affected employees at a single district; Methuen Public Schools reported 1,610+ employees. Districts named in reporting include Methuen (MA), Fort Worth ISD and Crowley ISD (TX) and Austin ISD (TX), with impact also reported in South Carolina and Connecticut; Haverhill, Salem (NH) and Andover were reported unaffected. As of SecurityWeek's November 3, 2026 report, 1,298,917 people were confirmed across five states with public portals (Massachusetts, New Hampshire, South Carolina, Texas, Vermont). Filings in California, Indiana and Iowa suggest the total exceeds 1.3 million. Class action litigation has been reported.

Frontline is offering two years of free credit monitoring and identity theft protection to adults in the US (via TransUnion) and cyber/dark-web monitoring for minors. Notifications are sent from frontline@notifications.cyberscout.com with enrollment at www.frontline-transunion.com and a support line of 833-516-8792 (BleepingComputer). Third-party risk managers should note the key lesson: the question is what the vulnerable application could reach, so vendors and districts should understand third-party access scope. Notification-themed phishing against affected staff is a foreseeable follow-on risk.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1213 Data from Information Repositories
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5157 Frontline Third-Party App/Build Server Spawning Recon or Download Process (T1190)** (`TL-2026-5157-SPL-001`)

Behaviour-first detection for the Frontline Education breach (TL-2026-5157): the exploited third-party product was described as software used to build, test and manage software and was reached via T1190. Flags web/app servers and CI build agents spawning LOLBins, recon tools or download cradles, the typical first post-exploit step. The vulnerability and CVE are undisclosed, so this is behavioural rather than signature based.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059
- **Data sources:** sysmon, windows_security, mde_device_process_events
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
  (ParentImage="*\\w3wp.exe" OR ParentImage="*\\java.exe" OR ParentImage="*\\javaw.exe" OR ParentImage="*\\tomcat*.exe" OR ParentImage="*\\node.exe" OR ParentImage="*\\php-cgi.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\gitlab-runner.exe" OR ParentImage="*\\Agent.Worker.exe")
```parent is a web/app server or CI build agent worker (T1190)```
| where match(Image,"(?i)[^a-z0-9_-](certutil|bitsadmin|mshta|whoami|nltest|net1?|curl|wget|cscript|wscript|regsvr32)[.]exe$") OR (match(Image,"(?i)[^a-z0-9_-](cmd|powershell|pwsh)[.]exe$") AND match(CommandLine,"(?i)(-enc|-encodedcommand|downloadstring|downloadfile|invoke-webrequest|iwr |invoke-expression|iex |https?://)"))
| stats count as events min(_time) as first_seen max(_time) as last_seen values(Image) as children values(CommandLine) as command_lines by host ParentImage User
| convert ctime(first_seen) ctime(last_seen)
| table host User ParentImage children command_lines events first_seen last_seen
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe","java.exe","javaw.exe","node.exe","php-cgi.exe","httpd.exe","gitlab-runner.exe","Agent.Worker.exe") or InitiatingProcessFileName startswith "tomcat"
| where FileName in~ ("certutil.exe","bitsadmin.exe","mshta.exe","whoami.exe","nltest.exe","net.exe","net1.exe","curl.exe","wget.exe","cscript.exe","wscript.exe","regsvr32.exe")
    or (FileName in~ ("cmd.exe","powershell.exe","pwsh.exe") and ProcessCommandLine matches regex @"(?i)(-enc|-encodedcommand|downloadstring|downloadfile|invoke-webrequest|iwr |invoke-expression|iex |https?://)")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: TL-2026-5157 Application or Build Server Spawning Recon or Download Child Process
id: 6f1c2a54-3b8e-4d7a-9c10-5e2b7a9d41f1
status: experimental
description: Detects web/application servers and CI build agents spawning reconnaissance, LOLBin or download-cradle child processes, a post-exploitation signature of T1190 abuse of a vulnerable third-party build/management product as in the Frontline Education breach.
references:
    - https://www.securityweek.com/frontline-education-data-breach-impacts-over-1-3-million/
    - https://www.bleepingcomputer.com/news/security/frontline-education-data-breach-impacts-school-district-employees/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\java.exe'
            - '\javaw.exe'
            - '\node.exe'
            - '\php-cgi.exe'
            - '\httpd.exe'
            - '\gitlab-runner.exe'
            - '\Agent.Worker.exe'
    selection_child_tools:
        Image|endswith:
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\mshta.exe'
            - '\whoami.exe'
            - '\nltest.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\curl.exe'
            - '\wget.exe'
            - '\regsvr32.exe'
    selection_child_shell:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - '-enc'
            - 'DownloadString'
            - 'DownloadFile'
            - 'Invoke-WebRequest'
            - 'Invoke-Expression'
            - 'iex '
            - 'http://'
            - 'https://'
    condition: selection_parent and 1 of selection_child_*
falsepositives:
    - Legitimate build pipelines that call curl, net or PowerShell download steps
    - Admin scripts launched from Jenkins or Azure DevOps agents
level: high

```

**Known false positives:**

- Build pipelines legitimately invoking curl, net.exe or PowerShell download steps
- Application health-check or deployment scripts run under Tomcat/Jenkins service accounts

**Tuning notes:** Baseline parent/child pairs for 14 days and allowlist known pipeline commands by CommandLine hash; restrict to internet-facing app and build servers via a host lookup; raise severity when the child makes an outbound connection within 60 seconds.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5157 Exploit Payload Patterns in Web Requests to Public-Facing Apps (T1190) (locked: unlock with TL Creds)
- TL-2026-5157 Password-Protected Archive Staging of Collected Data (T1560.001/T1005) (locked: unlock with TL Creds)
- TL-2026-5157 Frontline Breach-Notification Phishing From Non-CyberScout Senders (T1566) (locked: unlock with TL Creds)
- TL-2026-5157 Linux App/Build Server Spawning Shell or Download Utility (T1190/T1059.004) (locked: unlock with TL Creds)
- TL-2026-5157 Lookalike DNS for [indicator] / [indicator] (T1583.001/T1566.002) (locked: unlock with TL Creds)
- TL-2026-5157 Non-Browser Lookups of Anonymous File-Sharing Services (T1567.002/T1041) (locked: unlock with TL Creds)
- TL-2026-5157 Bulk Database Export of Personal Records (T1213/T1005) (locked: unlock with TL Creds)
- TL-2026-5157 Volumetric or Chunked Outbound Transfer from Servers (T1041/T1030) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 14)

Defanged, TLP:CLEAR.

- Domain: `frontline-transunion[.]com`
- URL: `hxxps://oag[.]ca[.]gov/system/files/2026.10.26_EX%20A_Frontline%20-%20Sample%20Adult%20Individual%20Notification_0.pdf`

Full set of 14 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Frontline Education Data Breach Impacts Over 1.3 Million (SecurityWeek)](https://www.securityweek.com/frontline-education-data-breach-impacts-over-1-3-million/)
- [Frontline Education data breach impacts school district employees (BleepingComputer)](https://www.bleepingcomputer.com/news/security/frontline-education-data-breach-impacts-school-district-employees/)
- [Frontline Education Breach Impacts K-12 School District Staff (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/frontline-education-breach-k12/)
- [Frontline Education Data Breach 2026: Third-Party Software Vulnerability Exposes K-12 School District Employee Data (Rescana)](https://www.rescana.com/post/frontline-education-data-breach-2026-third-party-software-vulnerability-exposes-k-12-school-district-employee-data)
- [California AG filing: Frontline sample adult individual notification](https://oag.ca.gov/system/files/2026.10.26_EX%20A_Frontline%20-%20Sample%20Adult%20Individual%20Notification_0.pdf)
- [Frontline Education data breach impacts school employees (GovTech)](https://www.govtech.com/education/k-12/frontline-education-data-breach-impacts-school-employees)
- [Frontline Education hack impacts Fort Worth, Crowley schools (GovTech)](https://www.govtech.com/education/k-12/frontline-education-hack-impacts-fort-worth-crowley-schools)
- [Austin ISD says staff data compromised after software breach (KXAN)](https://www.kxan.com/news/local/austin/austin-isd-says-staff-data-compromised-after-software-breach/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5157