South Carolina’s School Choice Program Hit by Phishing Scam Targeting Vendors Late last month, South Carolina’s private school choice program fell victim to a phishing attack in which hackers impersonated the state education agency or the payment platform ClassWallet to steal vendors’ banking details. The scam targeted service providers like Bridget Deline, owner of Upward Learning Center in Columbia, who warned the breach could cripple operations, leaving her thousands of dollars short in funding. The incident occurred just days before the U.S. Treasury released rules for a nationwide school choice program, raising concerns about cybersecurity vulnerabilities in similar initiatives. Doug Levin of the K12 Security Information Exchange called the attack a “warning shot,” emphasizing the need for stronger safeguards as more states adopt education savings account (ESA) programs. The South Carolina Department of Education notified vendors on September 25, instructing password resets and temporarily locking down ClassWallet for a risk assessment. The disruption halted fund disbursements, blocked vendor listings, and prevented parents from submitting invoices for tuition or tutoring. While the department later restored access, some vendors, including Deline, remained locked out days later, eroding trust in the program’s security. With $210 million allocated over three years, South Carolina’s Education Scholarship Trust Fund which provides $7,634 per student this year is one of over 20 ESA programs nationwide. The phishing tactic mirrored common attacks on public schools, where hackers intercept payment chains to divert funds. It remains unclear how many vendors fell for the scam or how much money was stolen, as the department continues verifying affected accounts. Officials are working with ClassWallet used by eight states to implement additional security measures. Levin noted the attack was “partially successful” and likely to inspire copycats, given the financial incentives of ESA programs. The breach follows other recent incidents, including a Missouri data leak exposing parent emails and scholarship details, and an Arizona error that revealed student disabilities and order information. Meanwhile, South Carolina is also responding to a separate cyberattack on Frontline Education, a school administration platform, which may have compromised student data in Anderson School District 2. As states prepare for the federal tax credit program launching next year, experts stress the need for robust security to protect donor and student information. The South Carolina attack underscores the growing cyber risks in education funding systems.

Frontline Education Data Breach Exposes Employee Information via Third-Party Vulnerability Frontline Education, an edtech provider serving school districts with workforce management software, has confirmed a data breach after attackers exploited a vulnerability in a third-party application to access its systems. The incident, detected on August 14, 2026, exposed sensitive employee data, including Social Security numbers, email addresses, and physical addresses. The company’s investigation conducted with an independent cybersecurity firm revealed unauthorized access to a portion of its environment. While Frontline has not disclosed the compromised third-party software or the initial breach timeline, it confirmed remediation efforts, law enforcement involvement, and additional security reinforcements. Notifications to affected school districts began circulating in early October, with some administrators initially questioning their legitimacy. However, multiple districts later verified the breach, with one reporting 1,210 impacted employees. Frontline is handling notifications on behalf of districts unless they opt out by October 16 via [www.frontline-transunion.com](http://www.frontline-transunion.com) or a dedicated hotline. Affected individuals will receive two years of free credit monitoring (adults) or cyber monitoring (minors) through TransUnion. Frontline has also committed to covering costs for state attorney general notifications and identity protection services. The full scope of impacted districts and individuals remains unclear.

Frontline Education Data Breach Exposes Third-Party Software Risks Frontline Education, an education technology provider, suffered a data breach after attackers exploited a vulnerability in third-party software used by the company. The incident exposed sensitive employee records, including Social Security numbers, though the specific third-party vendor involved has not been disclosed. The breach underscores the cascading risks of third-party dependencies in cybersecurity. While Frontline has remediated the vulnerability, the incident highlights the need for organizations to assess not only their direct vendors but also the security of the software those vendors rely on. Districts using Frontline’s services must now determine which records were accessible through the compromised application and whether similar exposure paths exist elsewhere in their systems. Michael Centrella of SecurityScorecard noted that only 13% of businesses continuously monitor third-party vendor security risks, emphasizing the broader challenge of supply chain security. The breach serves as a reminder that even robust vendor assessments may overlook vulnerabilities in secondary software components, leaving sensitive data at risk. The full scope of the breach’s impact on affected school districts remains under review.