Who pays when a vendor is breached? What the Frontline breach means for your next renewal

On August 14, 2026, Frontline Education found unauthorized access in part of its environment. The way in came through a vulnerability in a third-party software product Frontline uses. Frontline says the attack was fully contained by August 15. The products involved were Frontline Central, which handles workforce administration, and School Health Management, which supports school nursing.

The data taken varied by person, and it was the serious kind: names, Social Security numbers, dates of birth, driver's license numbers, passport and other government ID numbers, Medicaid IDs, and student IDs. Frontline began notifying districts in early October and started sending individual notification letters on or about October 26. Filings with attorneys general in five states put the number of affected people at 1,298,917, and the total is likely above 1.3 million. Frontline itself has not published a total. Frontline serves more than 10,000 K-12 organizations, and its software is used by more than 50 million students.

Your district did not cause this breach. No scan would have prevented it, and no review can undo it. But the breach still lands on a district's desk: notification letters to families and staff, credit monitoring, hours of staff time, questions from the board, and a legal review of what the vendor owes you.

That last question is the one most districts cannot answer on the day it matters. Who pays for notification, monitoring, investigation, and legal costs when a vendor is breached? The answer is in the contract and the DPA, and it is usually one of three things: the vendor covers it, the vendor covers it up to a cap, or the contract says nothing at all.

Indemnity is the clause that decides it. In plain English, an indemnity clause is a promise by the vendor to cover defined costs if a breach happens on its side. Three details decide whether the promise is worth anything. First, what costs it covers: notification, credit monitoring, investigation, legal costs. Second, whether there is a cap, and whether that cap covers a real notification to thousands of families. Third, the notice deadline: how quickly the vendor must tell you, and whether your team can meet its own notification duties inside that window. An exclusion can quietly remove the whole promise, and a cap set far below notification costs leaves the district paying the rest.

Most districts never read these clauses until after a breach, because the clauses live in terms of service and DPAs that are hard to find and harder to compare across vendors. That is the check to run before renewal, not after an incident.

What DueDilly checks

DueDilly's free scan starts with the evidence you can verify today. Upload a CSV of every vendor you use, or type vendor names, and the scan finds FERPA and COPPA evidence, security certifications, and source links for each vendor, then live-verifies every link. A green link means the source is reachable. A red link means it is broken or unreachable.

The review behind the scan looks at the same vendor's policies, contract terms, DPA terms, and your district's own priorities, and turns them into one scored review with an exportable packet for IT, purchasing, and leadership.

The free trial's review goes further, into the contract and DPA terms, including breach indemnity. For each vendor, it reads the public terms of service, DPA, and privacy policy, and reports whether breach indemnity language is present, what costs it covers, any cap in plain numbers, any exclusion, and any breach notice deadline, with the exact excerpt and its source link so you can show counsel. If the terms are not public or cannot be read, it says so instead of guessing. A flagged gap is a question for counsel and for renewal negotiation, not a verdict.

Two things this is not. It is evidence from public terms, not legal advice, and it does not replace district counsel. It does not guarantee a vendor will pay, and it does not prove compliance. Terms change, so every finding carries its scrape date and source link.

Check before renewal

Renewal is the moment you have leverage. Before the next one, check the vendors you already use. Run the free scan, then start a free 90-day trial and run one vendor that is already in your queue.

If you were affected by the Frontline breach, follow your district's notice and Frontline's own notice for next steps, including credit monitoring enrollment. DueDilly cannot help with individual monitoring claims.

Sources: Frontline Education, Notice of Data Breach, October 26, 2026; SecurityWeek, Frontline Education data breach impacts over 1.3 million, November 3, 2026; Cybernews, Hackers breach school tech giant serving 50 million students nationwide.

DueDilly provides vendor due diligence workflows and evidence. This post is not legal advice.