About 6,000 current and former Missoula County Public Schools employees and job applicants may have had their Social Security numbers, email addresses and home addresses exposed in a breach at a software company the district uses.

The district was notified on Oct. 26, MCPS told KPAX in a report published Nov. 10.

The company is Frontline Education, an education-software vendor used by school districts across the country for administration and workforce management.

What the district says happened

MCPS says the incident happened entirely inside the vendor’s systems. A district spokesperson told MTN that no district systems or networks were accessed or compromised.

That distinction matters for what you do next, but it does not change what may have been exposed. The categories the district named are the ones identity thieves use: Social Security number, email address, home address.

How it happened, in the company's own words

Frontline’s notification letter to an affected district, obtained by BleepingComputer, puts the start of it in mid-August:

“On August 14, 2026, our security team identified a vulnerability in a third-party software product we use that allowed unauthorized access to a portion of the environment.”

The letter says the company investigated with an independent cybersecurity firm, fixed the vulnerability, contacted law enforcement and tightened its systems. The company has not said which third-party product was involved, or when the unauthorized access actually began.

The company has reported that the incident affected about 1.3 million people nationally.

What has been done

• Frontline Education has notified the Montana Attorney General, according to the district
• It has notified the three national credit bureaus
• It is notifying the people affected directly

What to do if you get a letter

If you worked for MCPS, or applied to, and a notice arrives, treat it as real rather than as a phishing attempt — but verify it independently before clicking anything in it. Districts elsewhere initially could not tell whether the notification emails were genuine, because they arrived from an unfamiliar sending address.

A Social Security number cannot be changed the way a password can. The standard responses are a credit freeze with each of the three bureaus, which is free, and watching for accounts you did not open.

Any monitoring Frontline offers will be described in its own notice.

Sources

• KPAX, “Missoula school district suffers data breach through third-party education software,” Nov. 10, 2026
• BleepingComputer, “Frontline Education breach exposes school district employee data,” Oct. 2, 2026