The South Carolina Law Enforcement Division has been notified of a cybersecurity issue with Frontline Education, a software used by multiple school districts in the Upstate
ANDERSON, S.C. —
Several school districts in the Upstate are reporting a cybersecurity incident that may have compromised student and staff information.
The data breach involves two branches of a software called Frontline Education: Application Tracking, which stores Social Security numbers, addresses and other essential employee information, and Health Services, which stores student medical records and billing.
The scope and motive behind the incident are uncertain.
The South Carolina Department of Education confirmed the breach happened on Aug. 14, 2026, but the public was informed in early October:
“Protecting sensitive information is a top priority for South Carolina’s public schools and the Department. We are closely monitoring reports regarding a cybersecurity incident involving Frontline Education and are committed to sharing accurate information as it becomes available.
“Frontline Education is communicating directly with affected school districts regarding a cybersecurity incident involving its systems.
“At this time, the South Carolina Department of Education has not received direct notification from Frontline regarding the scope of the incident, including the number or identity of South Carolina school districts that may have been affected.
“According to information publicly reported and shared with affected organizations, Frontline began issuing breach notifications to affected school districts and employees on October 1, 2026. The company reported that while the incident was first publicly disclosed in October, the underlying intrusion was detected on August 14, 2026.
“Based on information released to date, the incident stemmed from a vulnerability in a third-party software product used within Frontline’s environment. Frontline has indicated that certain employee information may have been accessed, including Social Security numbers, email addresses, and home addresses. Law enforcement has been notified, and Frontline is offering affected individuals two years of complimentary credit monitoring and identity theft protection services.
“Districts that have received notifications from Frontline are best positioned to address questions regarding their individual circumstances and response efforts.”
The software is used by multiple school districts. As of Tuesday afternoon, WYFF News 4 can confirm Anderson School Districts 2, 3 and 5 were impacted.
As of Tuesday afternoon, each district within Anderson, Greenville and Spartanburg County has been contacted by WYFF News 4 to confirm or deny being impacted. Some, like Greenville County Schools, are monitoring the issue but have not been informed that their software was involved in the breach.
Anderson School District 3’s Dylan McCollough showed us an email received from a third-party called Cyberscout confirming the breach. Because it was from an outside source and not directly through Frontline, the district was hesitant to believe it in case it was a phishing scheme.
“We don’t have any control over it, unfortunately. Our team in the district works very hard to keep our information safe. We are working to ensure that it doesn’t happen again, if we can help that,” McCollough said.
Parents were notified starting on Oct. 1. Tiffany Do, a mother of three school children with special needs, remembers getting the alert on her phone and growing concerned her student’s information was in the wrong hands.
“I understand they (the district) don’t have a lot of information to give us… but as parents it’s very critical. It’s really nerve-wracking, to be honest,” Do said.
Anderson School District 5 shared this message with families:
“Dear Anderson Five Parents and Guardians:
“Anderson School District Five has received notification from a vendor representing Frontline Education, a provider of several systems used by the district, that Frontline experienced a cybersecurity incident compromising student information. Frontline provides several systems used by Anderson School District Five. We do not yet know the full scope of the incident, the types of information involved, or which individual students were affected.
“Our Information Technology & Security Services team has reported the notification to SLED in accordance with district procedures and continues to seek additional details directly from Frontline.
“Frontline will contact affected students’ families directly with information about their available options and next steps. We do not yet have further details about those options or the timing of the notifications.
“We understand that this news is concerning, particularly while questions remain unanswered. We take our responsibility to protect student information seriously and are working to obtain clear answers for our families. We will share additional confirmed information as it becomes available.
“Thank you for your patience as we work through this situation.”
Then on Tuesday afternoon, a parent provided an updated message from the district:
“Dear Anderson Five Families:
“We understand that the cybersecurity incident shared with you Friday may have raised concerns and left questions about your student’s information. We know how important clear answers are, and while we are still awaiting many specifics, we want to share what we know at this time.
“Frontline provides several systems used by Anderson Five. The incident involved, in part, its School Health module, which supports nursing services. According to Frontline, which has published a general notice on its website, the information compromised varies by school district and individual.
“Anderson Five has requested a comprehensive list identifying the students affected and the specific information compromised for each student, but we have not yet received it. Frontline will contact affected families directly with details and available next steps.
“Frontline states that its platforms are operational and secured. We recognize that this assurance does not answer every question or establish the full impact on Anderson Five. Please know that we are taking this situation seriously and continue to seek clear, specific answers for our families. In the meantime, we remain committed to transparency and sharing verified information as we receive it.
“Again, we appreciate your patience as we work through this situation.”
WYFF News 4 has reached out to Frontline Education and the Cyberscout team for comment.
The South Carolina Law Enforcement Division has been notified and is assisting with the incident through its South Carolina Critical Infrastructure Cybersecurity (SC CIC) team.
