Families in at least five Upstate South Carolina school districts are getting breach notifications this month after a vulnerability in third-party software used by Frontline Education allowed unauthorized access to student and staff information. Anderson School Districts Two, Three and Five, Greenwood School District 50 and Greenville County Schools have all flagged the incident to parents and employees, though officials say exactly what was exposed, and for how many people, still depends on which district and which individual you ask.
A Vulnerability Traced Back to August
According to WSPA, the underlying intrusion was detected on August 14, 2026, though Frontline did not begin notifying affected districts and employees until October 1. Frontline, which provides software used by school systems nationwide, said in its own statement that it identified a vulnerability in a third-party software product that allowed unauthorized access to part of its environment, and that the affected solutions were Frontline Central and School Health Management. The South Carolina Department of Education confirmed the breach occurred on August 14, 2026, as reported by WYFF News 4.
The company said the specific information involved varies by school district and by individual, a distinction playing out unevenly across the Upstate. Greenwood School District 50 reported that information from around 16,678 current and former students may have been impacted, including Medicaid identification numbers, email addresses and mailing addresses, per the same WSPA report. Anderson School District Three said information tied to its school health and applicant tracking systems may have been affected, while Frontline's health services branch stores student medical records and billing information and its application tracking branch holds Social Security numbers, addresses and other employee data, according to WYFF News 4.
Greenville County Schools Says Its Systems Were Not Breached
Greenville County Schools, which uses Frontline software for nursing-services documentation and Medicaid billing, said no internal systems were breached and that it has not been informed its software was involved, the district told WSPA. The district said it is continuing to monitor the situation. Employee data also appears to be at risk: Frontline indicated that certain employee information, including Social Security numbers, email addresses and home addresses, may have been accessed, the station reported.
In Anderson School District Three, the notification itself briefly became a source of confusion. The district received a breach-confirmation email from CyberScout but was hesitant to trust it at first, since it arrived from an outside source and could have been mistaken for a phishing attempt, according to WYFF News 4. District official Dylan McCollough said the district has limited control over the incident and is working to prevent a recurrence, the station reported.
Anderson District Five Still Waiting on a Full Accounting
Anderson School District Five said it received notification that a vendor representing Frontline Education had reported a cybersecurity incident compromising student information, and the district reported that notification to the South Carolina Law Enforcement Division, per WYFF News 4. But the district says it still does not know the full scope of the breach, which types of information were involved, or which individual students were affected. The district requested a comprehensive list of affected students and the specific information compromised for each one, but says it has not received that list and continues to seek clear, specific answers from Frontline, the station reported.
Parent Tiffany Do told WYFF News 4 that the lack of information about the incident was nerve-wracking. The South Carolina Law Enforcement Division is assisting with the incident through its South Carolina Critical Infrastructure Cybersecurity Team, according to the station, and law enforcement broadly has been notified of the breach.
State Officials Say They're Still in the Dark Too
Even the state education department says it lacks a full picture. The South Carolina Department of Education said it has not received direct notification from Frontline about the scope of the incident and does not know the number or identity of all affected South Carolina school districts, WYFF News 4 reported. The department said it is closely monitoring reports regarding the cybersecurity incident involving Frontline Education, per WSPA.
Frontline said it has remediated the vulnerability with help from an independent cybersecurity firm, engaged law enforcement, and implemented additional security controls and safeguards, according to the company's own statement. WYFF News 4 reported that Frontline's platforms are now operational and secured, and that the company will contact affected students' families directly with available options and next steps. Frontline is offering affected individuals two years of complimentary credit monitoring and identity-theft protection services, the company said.
What Families Can Do Now
South Carolina law requires businesses that maintain personal information they do not own to notify the data's owner immediately after discovering a breach, if the information was or is reasonably believed to have been accessed by an unauthorized person, under South Carolina Code Section 39-1-90. Separately, the federal Family Educational Rights and Privacy Act protects personally identifiable information in students' education records, according to guidance from the U.S. Department of Education's Student Privacy Policy Office.
The incident lands amid a broader pattern of pressure on school technology systems: districts nationwide are experiencing an average of five cyber incidents per week, according to the U.S. Department of Education. For now, the full number of affected districts and individuals in South Carolina remains unclear, and families in places like Anderson County are left waiting on Frontline and their own district offices for details that haven't yet arrived.
