Frontline Education has started sending breach notices to affected people, including families and school employees. If one arrives, use it to identify whose information was exposed and which protection is being offered before you enroll.
The company's October 26 notice concerns unauthorized access on August 14 and 15 involving Frontline Central and School Health Management. The October letters are notifications about that incident.
Read the notice for the person affected
The exposed information varies by individual and can include Social Security numbers, dates of birth and government or student identifiers. Frontline says eligible US adults are being offered two years of credit monitoring, with cyber monitoring for minors through TransUnion at no charge.
Keep the letter and its enrollment instructions. An offer addressed to a child needs the child's protection process; signing up for an adult's monitoring would not address that child's records. Check any enrollment deadline printed in the individual notice rather than assuming every recipient has the same date.
Monitoring, a freeze and an alert do different jobs
A monitoring service can help identify changes after they occur. A credit freeze restricts access to a credit file, making it harder to obtain new credit in that person's name. You can choose a freeze while also using monitoring.
The Federal Trade Commission's credit guidance explains the distinction between freezing a file and placing a fraud alert:
| Protection | What it does | Where to request it |
|---|---|---|
| Credit freeze | Restricts access to the credit file for new-credit checks | Contact Equifax, Experian and TransUnion separately |
| Initial fraud alert | Asks businesses to verify identity before extending credit | Contact one of those bureaus; it must notify the other two |
Both are free. An initial fraud alert lasts one year and can be renewed. A freeze stays until you lift it and does not lower your credit score. If a lender needs your report for an application, arrange a temporary lift with the relevant bureau.
A freeze addresses new-credit access. Continue checking accounts you already have, since that restriction does not substitute for reviewing charges, bank activity or bills. The Government Accountability Office's 2017 review of identity-theft services also distinguishes new-account fraud from existing-account misuse and other harms, such as medical or tax-refund identity fraud.
A child's credit file needs a separate request
The FTC recommends a free freeze for children under 16. A parent or legal guardian requests it through each of the three credit bureaus. Sixteen- and 17-year-olds can request and remove a security freeze themselves.
The agency's page links to each bureau's child-specific instructions. Use those instructions rather than an adult sign-up form: the documentation and verification process differ.
Most children under 18 do not have a credit report. The FTC says a parent can ask the bureaus for a manual search using the child's Social Security number. A bureau may require proof of your identity and address, the child's birth certificate and Social Security card, and guardianship documents where relevant. Send sensitive documents only through the bureau's verified process.
Warning signs include collection calls about accounts the child never opened, a benefit application rejected because the child's number is already in use, or an unexpected tax notice. Those are reasons to investigate specific records, not proof that every breach recipient has suffered identity theft.
Verify the route before sharing more information
An unexpected message about a breach can itself be a phishing attempt. The FTC advises contacting a company through a website or number you know is genuine, rather than using an unexpected message's link or phone number.
Frontline's published notice lists a TransUnion assistance line at 1-800-759-7279, weekdays from 8 a.m. to 8 p.m. Eastern, excluding major US holidays. You can reach the same notice by navigating to Frontline's website yourself.
Never send a Social Security number or a photograph of an identity document in a reply to an unsolicited message. Verify the recipient and enrollment route first, even when the message names your school or correctly describes the breach.
If you find an unfamiliar account, contact the business's fraud department and dispute it with the credit bureaus. The FTC's IdentityTheft.gov provides a reporting and recovery process. Keep copies of the breach notice, any disputes and the responses so you can follow the same case through to resolution.
The FTC's short video, What To Do After a Data Breach, explains how to use its recovery resources.
