School district employees and job applicants whose records were involved in the Frontline Education data breach identified in August 2026 may be covered by proposed class actions alleging Frontline Technologies Group failed to protect their Social Security numbers, home addresses and email addresses. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action complaints. The statements below are unproven allegations. Frontline Technologies Group has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Happened at Frontline Education?
Frontline Technologies Group, which does business as Frontline Education, sells human resources, payroll, absence-management and student-records software to K-12 school districts from its base in Wayne, Pennsylvania. Districts that use it hand over employee personnel data, so a Frontline breach reaches teachers and other school staff who may never have heard of the company.In the notice it sent to districts, Frontline says its security team identified a vulnerability on August 14, 2026, in a third-party software product the company uses, and that the flaw allowed unauthorized access to a portion of its environment. Frontline says it investigated with an outside cybersecurity firm, fixed the vulnerability and contacted law enforcement. It has not named the third-party product or said when the access began. On its website, Frontline says the data involved related to two of its products, Frontline Central and School Health Management, and that districts using neither were not affected.
Six proposed class actions followed in the U.S. District Court for the Eastern District of Pennsylvania, the first on October 5, 2026 and the most recent on October 13. No court has ruled on any of the allegations.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Who Is Getting Frontline Breach Letters
Frontline began notifying districts around October 1, 2026, and gave them until October 16 to opt out of having Frontline notify their affected employees on their behalf, BleepingComputer reported. The notice posted by Farmington Public Schools in Connecticut says Frontline will reach individuals by email, by mail and through substitute notice on its website, and will file the notices state attorneys general require.District statements give different start dates for those individual letters. Waco ISD said Frontline will begin contacting affected people on October 26, 2026, KXXV reported. Glendale Unified School District in California told staff in an October 6 email that individual notices would go out on or about October 17, according to a complaint that quotes the email. Frontline’s support page says data files it requested from TransUnion were delayed for validation.
The people involved so far are mainly current and former district employees. Waco ISD said job applicants were affected too, and so did Glendale Unified’s staff email, as quoted in the Rezayat complaint. Student data is less clear:
- Waco ISD said Frontline told it no Waco ISD student information was exposed.
- In South Carolina, Anderson School District Two told parents that student information may have been compromised, HERE Columbia reported. The outlet tied the incident to Frontline products that store employee records and student medical and billing records.
- Greenville County Schools, which uses Frontline for nursing documentation, said it had not been notified of any impact.
Frontline has not published a nationwide count. Individual district notices give a sense of scale: Farmington’s lists 2,129 of its employees, and BleepingComputer reported a notice covering 1,210 employees at another district.
According to Frontline’s notice, adults receive two years of credit monitoring and identity theft protection through TransUnion at no cost, and minors are offered cyber monitoring. The notice says Frontline is paying for the notices and the monitoring. Frontline’s support page says each letter lists the categories of information involved for that district and includes a unique passcode for enrolling. In the Farmington notice, Frontline said it was not aware of any misuse of the information.
The Six Lawsuits
All six cases name Frontline Technologies Group as the defendant and are pending in Philadelphia. Four are assigned to one judge and two to another.- Brooks v. Frontline Technologies Group LLC, No. 2:26-cv-07630, filed October 5. The plaintiff, an Arkansas resident, says her job required her to use Frontline’s software and give it her personal information.
- Shaw v. Frontline Technologies Group, LLC, No. 2:26-cv-07678, and Steinman v. Frontline Technologies Group, LLC, No. 2:26-cv-07688, both filed October 6 by the same lawyer. Each plaintiff says he is a former Frontline employee who gave the company his information as a condition of working there.
- Grant v. Frontline Technologies Group LLC, No. 2:26-cv-07706, filed October 7 by two plaintiffs against Frontline Technologies Group doing business as Frontline Education. It is brought on behalf of others similarly situated, but the complaint itself is not yet on the public docket.
- Denuto v. Frontline Technologies Group, LLC, No. 2:26-cv-07820, filed October 12. The plaintiff says she retired in 2026 after 27 years as an educator with a New Jersey school district that uses Frontline for absence management and payroll.
- Rezayat v. Frontline Technologies Group LLC, No. 2:26-cv-07838, filed October 13. The plaintiff is a current Glendale Unified School District employee in California.
What the Complaints Allege
The five public complaints tell broadly the same story. They allege that Frontline collected and kept Social Security numbers and contact details entrusted to it and did not use reasonable safeguards to protect them, leaving the people affected at increased risk of identity theft and fraud. Each seeks money damages on behalf of a class, and several also allege that Frontline was too slow to tell the people affected.The legal claims overlap. Every public complaint pleads negligence, unjust enrichment and breach of implied contract. Brooks, Shaw, Steinman and Denuto add negligence per se, and Brooks adds breach of confidence. Rezayat adds breach of a third-party beneficiary contract and, for a California subclass, a claim under the California Consumer Privacy Act.
The Rezayat complaint is the most detailed. It alleges that Frontline should have patched the vulnerability in the third-party software sooner and should not have kept data on former employees and applicants it no longer needed. Its proposed remedies include a court-ordered security program, encryption, closer oversight of Frontline’s own vendors, and deletion of data Frontline no longer needs. The complaint estimates, on information and belief, that the class likely includes hundreds of thousands of people.
Each complaint proposes its own class. Brooks proposes everyone in the United States whose information was compromised in the breach. Shaw and Steinman limit theirs to people who were affected and received a notice. Denuto covers everyone in the United States affected by the breach, including notice recipients, and Rezayat proposes everyone whose information was accessed or taken, plus a California subclass. These are proposals; a court has to certify a class before anyone is formally part of the case.
What Is Still Unknown
Frontline has not said how many districts or people were affected, which third-party product was involved, when the unauthorized access began, or exactly what was taken from each district. Its state attorney general filings, which it said it would make on districts’ behalf, may answer some of those questions as they are posted.The suits also differ on who the victims are. Frontline’s notices describe employees of client districts, while two of the plaintiffs say they are former Frontline employees. Which groups the breach actually reached is a factual question the cases have not yet resolved.
What Happens Next
All six cases sit in the same court, and four are already before one judge, so they may be consolidated into a single case with one set of lawyers leading it. More complaints may be filed as individual letters reach school employees. As of October 13, 2026, no answer or motion from Frontline responding to any complaint appeared on the dockets.There is nothing to file in the lawsuits now. If a settlement is reached, people it covers would normally receive a notice explaining how to file a claim. Earlier coverage of the first Frontline filings, alongside breach suits against Live Nation and Saber Healthcare, is in OCA’s roundup of the three companies’ data breach lawsuits. Data breach settlements that are open for claims now are listed on the data breach settlements page.
Questions
Is there a Frontline Education data breach class action?
Yes. Six proposed class actions against Frontline Technologies Group were filed in the U.S. District Court for the Eastern District of Pennsylvania between October 5 and October 13, 2026: Brooks, Shaw, Steinman, Grant, Denuto and Rezayat. Five of the complaints are public and all five concern the breach Frontline identified on August 14, 2026. All six cases are at the complaint stage. No class has been certified and there is no settlement.
Why are school employees getting Frontline Education breach letters?
Many school districts use Frontline software to keep personnel records, so employee information the districts collected was stored in Frontline’s systems. Frontline says the affected data related to two of its products, Frontline Central and School Health Management, and that districts using neither product were not affected. A letter from Frontline does not mean the recipient ever dealt with the company directly.
What information was exposed in the Frontline Education breach?
The notices that districts have shared list Social Security numbers, email addresses and home addresses for affected employees, and Crowley ISD in Texas told staff that names may also be included. Frontline says each notice lists the categories of information involved for that district. In one notice, Frontline said it was not aware of any misuse of the information.
Were students affected by the Frontline Education breach?
It depends on the district. Waco ISD said Frontline told it that no Waco ISD student information was exposed. In South Carolina, Anderson School District Two told parents that student information may have been compromised, and local reporting tied the incident in part to a Frontline product that holds student health records. Frontline’s notice offers cyber monitoring for minors, but Frontline has not published a count of students affected.
Is there anything to claim from the Frontline Education lawsuits?
No. There is no settlement, no claim form and no deadline. The two years of TransUnion credit monitoring described in Frontline’s notice letters is a company offer, not a payment from the lawsuits. If the cases settle, people covered by the settlement would normally receive a notice explaining how to file a claim.
What happens next in the Frontline Education lawsuits?
All six cases are in the same federal court, and four are assigned to the same judge, so they may be consolidated into a single case. No response from Frontline to any of the complaints appeared on the dockets as of October 13, 2026. More suits may follow as individual notice letters reach school employees.
Sources
• Class Action Complaint, Brooks v. Frontline Technologies Group LLC, No. 2:26-cv-07630 (E.D. Pa., filed October 5, 2026): Brooks complaint (PDF) and docket.• Class Action Complaint, Shaw v. Frontline Technologies Group, LLC, No. 2:26-cv-07678 (E.D. Pa., filed October 6, 2026): Shaw complaint (PDF) and docket.
• Class Action Complaint, Steinman v. Frontline Technologies Group, LLC, No. 2:26-cv-07688 (E.D. Pa., filed October 6, 2026): Steinman complaint (PDF) and docket.
• Grant v. Frontline Technologies Group LLC, No. 2:26-cv-07706 (E.D. Pa., filed October 7, 2026): docket (complaint not yet public).
• Class Action Complaint, Denuto v. Frontline Technologies Group, LLC, No. 2:26-cv-07820 (E.D. Pa., filed October 12, 2026): Denuto complaint (PDF) and docket.
• Class Action Complaint, Rezayat v. Frontline Technologies Group LLC, No. 2:26-cv-07838 (E.D. Pa., filed October 13, 2026): Rezayat complaint (PDF) and docket.
• Frontline Education: Information and Support Regarding Recent Cybersecurity Notifications.
• Farmington Public Schools (Connecticut): Frontline Education Data Breach (district page with Frontline’s notice).
• BleepingComputer: Frontline Education breach exposes school district employee data (October 2, 2026).
• KXXV: Waco school employees’ data exposed in security breach.
• HERE Columbia: Frontline Education data breach and South Carolina school districts (October 8, 2026).
• GovTech, republishing the Fort Worth Star-Telegram: Frontline Education Hack Impacts Fort Worth, Crowley Schools (October 9, 2026).
