Michael Centrella, Head of Public Policy at SecurityScorecard, comments, “School districts entrust vendors with sensitive employee information, but the risk also extends to the software those vendors rely on. Frontline says attackers gained access through a vulnerability in third-party software it used. That creates a chain of exposure from the software provider, through Frontline, to the districts whose employee records it held. A district can assess its direct vendor and still have limited visibility into another product that provides a path to its data.

“The important security question is what that vulnerable application could reach. Frontline says it remediated the vulnerability, but affected districts also need to understand which records were accessible through it and what controls limited that access. Fixing the entry point addresses one part of the incident. Districts need to understand why access through that application exposed sensitive employee records and whether similar access paths remain elsewhere in the environment.”