Got a letter about the Frontline data breach? Which Frontline products were involved, what data was exposed, and what a substitute can do now

Frontline Education says someone gained unauthorized access to a part of its systems that holds data from two products, Frontline Central and School Health Management. Absence Management, the part of Frontline that substitutes use to find and book jobs, is not one of the two it names. What was taken differs by district and by person, and your letter lists your own items. Adults who get a letter are offered 24 months of TransUnion credit monitoring at no cost. Two free steps help whether or not a letter came: a credit freeze at all three credit bureaus, and an IRS Identity Protection PIN.

We read every page cited here on October 19, 2026. This post reports what Frontline, the Federal Trade Commission and the IRS publish. It is not legal advice. Only your district's HR office and the call center named in your letter can tell you what was involved for you.

What happened, by Frontline's account

A sample of Frontline's letter to individuals is posted on the California Attorney General's website. It says: "On August 14, 2026, our security team identified a vulnerability in a third-party software product we use that allowed unauthorized access to a portion of the environment beginning August 13, 2026." The letter says Frontline then investigated with an independent cybersecurity firm, fixed the vulnerability and contacted law enforcement.

Frontline has not named that software product, as BleepingComputer noted on October 2. We will not guess at it.

Frontline's notice page says the access reached "a portion of our environment that contains data related to Frontline Central and School Health Management products." It says Frontline "has notified all affected school districts via email to two points of contact." Its FAQ says those were usually "superintendents, chief human resources officers, or their deputies."

Districts heard first. BleepingComputer reported that one district's superintendent and business manager "received the notification on October 1," and that Frontline would notify individuals itself "unless a district opts out by October 16." It added: "If a district opts out, Frontline says it will not provide notification services." In a district that opted out, the district's own HR office is where to ask how people are being told.

Was the job board involved?

Frontline names two products and no others. Its product page describes Frontline Central this way: "Manage every employee document and workflow in one connected system." The same page offers to "Store forms directly in employee profiles." School Health Management is, in Frontline's words, "An award-winning K-12 electronic health records system purpose-built to serve school health professionals." School nurses use it to record student visits.

Absence Management does not appear in the notice. The FAQ answers "Can we continue using Frontline products?" with "Yes. All products are working as they should and are secure." Frontline describes no change to how jobs are posted or booked.

So the question for a substitute is not whether you book jobs through Frontline. It is whether a district you work for kept your employee file or hiring forms in Frontline Central. The notice page says: "Districts that do not or have not used Frontline Central and/or School Health Management were not impacted by this incident." That wording covers districts that used either product in the past, not only districts that use one now.

If you sub in more than one district, ask about each one separately. A letter about one district tells you nothing about another. If you are not sure your district runs on Frontline at all, our post on telling Frontline from SmartFind Express shows how to check.

What data was exposed

Frontline does not publish a single list. Its notice page says: "The information involved varies by school district and by individual." The sample letter leaves a blank where the list goes: "We have determined that your INSERT DATA ELEMENTS were obtained." Your own letter fills in that blank with your items, so read that sentence first.

Reports based on district notices describe the same three kinds of data. BleepingComputer reported that one district's notice listed Social Security numbers, email addresses and physical addresses. The Eagle-Tribune report republished by GovTech says the exposed data potentially includes addresses, email addresses and Social Security numbers.

Students were included in some districts. The FAQ says Frontline sent notices to "all school districts whose staff and/or students' personal information was impacted." BleepingComputer reported that "minors will be offered cyber monitoring services." If you are also a parent, a letter about your child is separate from a letter about you.

Neither Frontline's notice page nor its sample letter mentions passwords or logins.

What the letter offers, and its two deadlines

The sample letter offers "at no cost a 24-month membership to TransUnion’s credit monitoring." You enroll at mytrueidentity.com with the activation code printed in the letter. The letter says: "You must enroll by January 31, 2027 to receive these services."

Its attachment gives a second deadline: "you must enroll within 90 days from the date of this letter." For a letter dated before November 2, 2026, those 90 days end before January 31. A letter dated October 15, for example, reaches 90 days on January 13, 2027. If your letter has both lines, enroll before the earlier date, or ask the call center which one applies.

Know what the monitoring covers. The attachment calls it "Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services." Single bureau means it watches one of your three credit files, not all three. It also includes help with fraud from Cyberscout, which the letter calls "a TransUnion company specializing in fraud assistance and remediation services."

Questions about the letter go to the call center it names, 1-833-516-8792, open "from 8 a.m. to 8 p.m. ET Monday through Friday, excluding major U.S. holidays." The notice page also gives an email address, frontline@transunion.com.

Is the email real?

The notice page names two addresses that notices come from: frontline@notifications.cyberscout.com, and Frontline's own no-reply@support.frontlineed.com. It also says: "Please check your spam folder for a message from that address." Be careful with an email about this incident from any other address, or with a call asking for your Social Security number or activation code. Check with your district's HR office before you act on either.

Free steps that do not depend on the letter

Monitoring tells you after something changes. The steps below make changes harder, and none of them costs anything.

• Freeze your credit at Equifax, Experian and TransUnion. The FTC's page on credit freezes and fraud alerts says: "There’s no cost to place or lift a credit freeze." It also says a freeze "lasts until you lift it" and "doesn’t affect your credit score." You have to contact each of the three bureaus yourself. Frontline's sample letter warns that a freeze may delay approval of new loans, credit, housing or employment, so lift it before you apply for any of those.
• Or place a fraud alert. The same FTC page says "An initial fraud alert lasts one year, but you can renew it," and the bureau you contact must tell the other two. A fraud alert asks lenders to confirm it is you. It does not stop new credit the way a freeze does.
• Check your credit reports. The FTC's free credit reports page says you can "check your credit report from each once a week for free" at AnnualCreditReport.com. The sample letter says once a year. The FTC's page, updated June 2026, says once a week. Look for accounts you did not open.
• Get an IRS Identity Protection PIN. The IRS IP PIN page says it is "a six-digit number that prevents someone else from filing a tax return" using your Social Security number. Anyone with an SSN or ITIN who can verify their identity can get one, and "A new IP PIN is generated each year for your account." If your letter lists your Social Security number, this is the step that guards against a fake tax return.
• If you find misuse, report it at IdentityTheft.gov, the FTC's reporting site. The sample letter also says to report known or suspected identity theft to law enforcement, your state attorney general or the FTC.

If no letter came

Most of Frontline's notice page is written for districts. Its FAQ says: "All notifications to impacted districts have been sent." Letters to individuals are a separate step, and the page says Frontline "will be notifying individuals whose personal information was affected where appropriate." So having no letter yet does not settle the question. Check your spam folder for the two addresses above. Then ask your district's HR office:

• Does the district use Frontline Central or School Health Management, or did it ever use either one?
• Did Frontline notify the district, and what kinds of data did that notice list for staff?
• Did the district opt out of having Frontline notify people? If it did, how is it notifying substitutes?
• Are substitutes' files kept in the same system as other staff files?

Ask every district you work for. A no from one district is not a no from the others.

What we can't tell you

• Whether your data was involved. Only your letter, your district or the call center can say.
• How many people were affected. Frontline's notice page gives no count.
• Which third-party product let the attacker in.
• Whether the data has been misused. Frontline's notice page does not address it.
• Whether anyone will be compensated. That is a legal question, and this post does not cover it.

Where Sub Hero fits

Sub Hero is independent and not affiliated with Frontline Education. It did not send these notices, it has no part in the TransUnion offer, and it cannot see whether a district used Frontline Central or School Health Management. For anything about your own data, go to your letter and your district's HR office.

Learn more: app.getsubhero.com

Plans start at $6.99/month. Works with Frontline Absence Management.