THE CRUNCH
Frontline Education, a provider of administration software for K-12 school districts, has told the Indiana Attorney General's Office that its August data breach affected 3,085,266 people, including school district staff and students. That is well over twice the roughly 1.3 million total from the company's earlier filings with several other states, so the reported scale has grown considerably as more notifications have gone out.
The company detected the intrusion on 14 August and says it fully contained the attack the next day. According to Frontline, the attackers got in by exploiting a vulnerability in a third-party software product, which it has not named, and no known cybercrime group appears to have claimed the attack.
Data was taken from two Frontline products, Frontline Central and School Health Management. What was exposed varies by individual but may include names, Social Security numbers, dates of birth, driver's licence numbers, passport and other government ID numbers, health insurance details such as Medicaid IDs, and student IDs.
Affected adults in the US are being offered two years of free credit monitoring and identity theft protection, while eligible minors get free dark web monitoring.