Education Sector Security Intelligence

Frontline Education experienced a cybersecurity event on August 14, 2026, due to a vulnerability in a third-party software product. This vulnerability allowed unauthorized access to a portion of their environment. The company has since remediated the vulnerability, engaged law enforcement, and is offering affected individuals 24 months of free credit monitoring through TransUnion. They are also enhancing their security measures.

Educational Testing Service (ETS), under contract with the California Department of Education (CDE), experienced a data security incident where unauthorized access to and copying of student data occurred from an ETS secure file transfer protocol (SFTP) site. The incident, which took place between May 22, 2026, and September 18, 2026, involved the use of compromised login credentials. The accessed data includes student demographic, program participation, and assessment information, but explicitly excludes Social Security numbers, driver’s license numbers, passport numbers, financial account information, credit or debit card information, or account passwords. ETS has taken the affected SFTP site offline, built a new one with enhanced security, and is offering complimentary identity-protection services through Experian IdentityWorks for two years to affected students.

Inner City Education Foundation (ICEF) discovered suspicious activity on its network on September 30, 2024. An investigation, with the help of third-party cybersecurity specialists, determined that an unauthorized actor gained access to certain ICEF systems and may have taken information between August 4 and September 29, 2024. The company is notifying potentially affected individuals and offering 12 months of free credit monitoring services through Cyberscout, a TransUnion company.

The American Board of Preventive Medicine (ABPM) experienced a cybersecurity incident where an unauthorized actor gained access to their network environment. Following an investigation, it was discovered on or about September 24, 2026, that certain electronic files accessed and/or acquired between March 8, 2026, and March 10, 2026, contained personal information, specifically full names. ABPM is offering complimentary credit monitoring, a $1,000,000 insurance reimbursement policy, and identity theft recovery services to affected individuals.

Frontline Education, a provider of K-12 school administration software, experienced a cybersecurity event on August 14, 2026, after a vulnerability in a third-party software product was exploited, granting unauthorized access to a portion of their environment starting August 13, 2026. The company has investigated the incident with an independent cybersecurity firm, remediated the vulnerability, and engaged law enforcement. They are offering affected individuals a 24-month membership to TransUnion's credit monitoring services. The specific data elements exposed are not detailed in the provided notification but are stated to be determined through an ongoing analysis.

On August 28, 2026, Tulare Joint Union High School District identified unauthorized activity on its network. The district took immediate steps to secure the network and engaged third-party specialists. On August 30, 2026, it was determined that certain files and folders were copied or downloaded by an unknown actor. A review of the affected data was completed on September 18, 2026, and it was determined that names and addresses may have been exposed. The district is notifying affected individuals and offering complimentary credit monitoring and identity protection services.

Alisal Union School District experienced unusual activity on their computer network on or around June 22, 2026. An investigation determined that certain information may have been accessed or downloaded without authorization on or around June 19, 2026. The review of affected information was completed on October 1, 2026, and notification was provided thereafter. The district is offering 12 months of credit monitoring and identity protection services through Experian.

Nishiyamato Academy experienced unauthorized access to its computer network between March 25, 2026, and March 28, 2026. The investigation revealed that certain files containing personally identifiable information, including full name, may have been accessed or acquired. The company is offering complimentary identity monitoring services to affected individuals.

Bennett College disclosed a data breach on May 5, 2026. The notification letter provides contact information for inquiries and encourages individuals to monitor their accounts for suspicious activity. It also outlines rights regarding fraud alerts and credit freezes, including the necessary information to place them. The college is offering free credit monitoring and identity protection services for 12 months to affected individuals.

Merced Union High School District detected unauthorized network activity on August 12, 2025, which could have impacted personal information including name, date of birth, Social Security number, and in some instances, health-related information. The district has secured the network, engaged third-party experts, and notified law enforcement. They are offering 12 months of free single bureau credit monitoring and fraud assistance through Cyberscout.

The Moody Bible Institute of Chicago experienced a data breach on June 12, 2026, when unusual activity on their computer network was detected. An internal review and engagement of a forensic security firm confirmed that some personal information was illegally acquired from their system around the same date. The breach was caused by a vulnerability in a software application commonly used by educational institutions. The compromised data included names, and the institute is offering a complimentary one-year membership of Kroll 3B Identity Monitoring Services to affected individuals.

Lincoln Technical Institute, Lincoln College of Technology, and Nashville Auto-Diesel College experienced a cybersecurity incident involving their learning management system vendor, Instructure Holdings, Inc. (Canvas). Unauthorized activity was detected on April 29, 2026, and again on May 7, 2026. While the full extent of access is unknown, the impacted systems may have contained student names, email addresses, student ID numbers, course names, enrollment information, and direct messages within Canvas. No evidence of misuse or access to core learning data, passwords, dates of birth, government identifiers, or financial information has been found.

Monmouth University disclosed a data breach affecting an unknown number of individuals.

Santa Monica Community College (SMC) is notifying individuals of a data breach where employee W-2 forms were emailed to two former student workers. The unauthorized access occurred from April 13, 2026, to May 21, 2026. The exposed information may include first and last name in combination with Social Security numbers. SMC has confirmed the email has been deleted and has no evidence of misuse. The college is offering complimentary credit monitoring and identity protection services and has reviewed its data protection policies and procedures.

Nelson University disclosed a data breach on March 21, 2025. The notification letter does not specify the date of the incident or the number of records affected. The exposed data includes names, addresses, dates of birth, and Social Security numbers. The university is offering a confidential toll-free response line for further questions and has provided guidance on placing security freezes, obtaining free credit reports, and reporting identity theft to relevant authorities like the FTC and state Attorney General offices.

Bellflower Unified School District experienced unauthorized activity within its computer systems. A third-party forensic investigation determined that personal information, including first and last name, may have been accessed by an unauthorized third party. The district is offering complimentary credit monitoring services and advises individuals to remain vigilant in monitoring their accounts.

The Bozeman School District #7 disclosed a data breach on June 3, 2026. The specifics of the breach, including the date it occurred, the date it was discovered, the number of records affected, the types of data exposed, and the attack vector, are not provided in the available information.

Strategic Education Inc. disclosed a data breach on June 1, 2026. No further details regarding the date of occurrence, discovery, records affected, data exposed, or attack vector were provided in the available information.

The University of Dallas experienced a data breach that was disclosed on May 29, 2026. Specific details regarding the date of the incident, the number of records affected, the types of data exposed, and the attack vector are not available in the provided information.

Educational Employees Credit Union experienced a data breach on December 15, 2025, when an unauthorized individual gained access to an employee email account for a limited period. The credit union discovered the incident on the same day and initiated an investigation with cybersecurity professionals. The investigation concluded on May 8, 2026, determining that certain emails containing personal information may have been accessed or removed. While there is no evidence of financial fraud or identity theft, the credit union is offering two years of complimentary identity monitoring services through Kroll, which include credit monitoring, fraud consultation, and identity theft restoration.

The University of St. Thomas-Houston disclosed a data breach on May 26, 2026. Specific details regarding the date of occurrence, discovery, number of records affected, types of data exposed, and the attack vector are not provided in the available information.

The Pierce County Library System experienced a data breach that was disclosed on May 25, 2026. The specifics of the breach, including the date of occurrence, the number of records affected, the types of data exposed, and the attack vector, are not provided in the available information.

Southern California University of Health Sciences disclosed a data breach on May 19, 2026. The specifics of the breach, including the date it occurred, the date it was discovered, the number of records affected, the types of data exposed, and the attack vector, were not provided in the available information.

The Dental Studies Institute disclosed a data breach on May 13, 2026. No further details regarding the date of the incident, the number of records affected, the specific data exposed, or the attack vector were provided in the available information.

Las Lomitas Elementary School District (LLESD) was notified by Instructure, the publisher of the Canvas LMS, on May 5, 2026, that a criminal threat actor had gained access to LLESD information on the Canvas platform. The breach affected students in 6th, 7th, and 8th grade during the 2023-2024 school year, their caregivers, and staff. The exposed data includes first and last names, email addresses, and class enrollments. Instructure stated there was no indication that passwords, dates of birth, government identifiers, or financial information were involved. LLESD IT confirmed the compromised data after reviewing the information within Canvas.

The Wisconsin Education Association Council (WEAC) disclosed a data breach on May 11, 2026. The specifics of the breach, including the date it occurred, the number of records affected, the types of data exposed, and the attack vector, are not publicly available at this time.

The Chaffey Joint Union High School District disclosed a data breach on May 1, 2026, affecting data shared with Canvas, a platform provided by Instructure. The breach involved messages within Canvas, the content of which may vary by individual. The district has temporarily disabled data sharing between Canvas and its student information system, is monitoring local Canvas activity, and is receiving updates from Instructure. Parents and guardians are advised to reset their Canvas passwords, while students are not required to take immediate action. The district recommends vigilance for unusual activity on Canvas and related email accounts and advises caution regarding unverified communications about the incident.

Information regarding a data breach at Goodwin University, Inc. was disclosed on May 4, 2026. Specific details about the date of the incident, the number of records affected, the types of data exposed, and the attack vector are not provided in the available information.

Blanchard Training & Development, Inc. discovered unusual activity in its network on March 4, 2026, which an investigation revealed may have involved the copying of certain personal information by an unauthorized individual between March 3 and March 4, 2026. The company is providing affected individuals with 12 months of free credit monitoring and fraud assistance services through Cyberscout.