Social Security numbers, driver's license numbers and home addresses of nearly 38,000 people connected to Klein ISD may have been exposed in a data breach at a third-party software vendor.

The breach hit Frontline Education, a company Klein ISD uses for human resources functions, the Houston Chronicle first reported. A report filed with Texas Attorney General Ken Paxton's office on Oct. 16 identified 37,966 people whose personal information was potentially compromised.

The breach occurred on Frontline's end, not within Klein ISD's own systems, the district told staff in an email obtained by the Chronicle. Attackers exploited a vulnerability in a third-party software product integrated with Frontline's systems, gaining unauthorized access to employee records.

"Attackers exploited a vulnerability in Frontline's system via a third-party system to gain unauthorized access to information such as Social Security numbers, driver's license numbers, home addresses and email addresses," the district wrote to employees.

Frontline's security team identified the vulnerability on Aug. 14, according to Infosecurity Magazine. The company has not disclosed when the unauthorized access first began. Aug. 14 marks when the problem was found, not necessarily when the intrusion started, according to Class Action U.

Frontline told Klein ISD it repaired the vulnerability and implemented additional safeguards, the Chronicle reported. A statement from Killeen ISD, another affected Texas district, said Frontline also hired an independent cybersecurity firm and notified law enforcement.

The company began notifying school districts on Oct. 1. Frontline told districts it would handle individual notifications unless a district opted out by Oct. 16, according to Class Action U. Klein ISD's communications team confirmed to the Chronicle that the district was affected.

What affected employees should do

Frontline plans to contact affected individuals by email and U.S. mail beginning Oct. 26, according to the Killeen ISD statement. Those contacted will receive two years of complimentary credit monitoring and identity theft protection through TransUnion, Klein ISD told its staff.

A dedicated hotline is available at 833-516-8792, Monday through Friday, 7 a.m. to 7 p.m. Central time.

Klein ISD warned employees to watch for fraudulent emails, texts or phone calls attempting to exploit the breach. The district urged staff to avoid responding to unexpected requests for personal information or passwords.

Frontline said it is not aware of any misuse of the stolen data. The company provides administration software to more than 80,000 schools nationwide, according to McAfee's security blog. The full number of districts and individuals affected across the country has not been published.

Michael Centrella, head of public policy at SecurityScorecard, told Infosecurity Magazine that questions remain. Districts still need to understand which records were accessible through the vulnerability and whether similar access paths exist elsewhere in Frontline's systems, he said.

Affected individuals can check their credit reports for free at annualcreditreport.com and consider placing a fraud alert or credit freeze with Equifax, Experian and TransUnion. The Federal Trade Commission offers guidance at identitytheft.gov/databreach.