The Florida Department of Education says criminals broke into its student financial aid website and that the personal data of as many as 4.9 million people may have been affected, including Social Security numbers. Anyone who has applied for Florida student aid should treat their identity data as potentially exposed and take protective steps now.
What happened
According to the department’s public notice, staff became aware on October 19 of a breach involving “unauthorized criminal access” to the Florida Student Financial Aid website, FloridaStudentFinancialAidSG.org. The department says it believes the incident was limited to that site and may have affected approximately 4.9 million individuals. It reported the incident to the Florida Attorney General’s office as state law requires and is working with the Florida Digital Service and the Florida Department of Law Enforcement, which is running a criminal investigation.
The department lists the data that may be involved: Social Security numbers, first and last names, dates of birth, home addresses, phone numbers including mobile numbers, email addresses, and gender identification codes (M or F). It says not every person was necessarily affected and that the data varies by individual. Local reports on October 29 carried the same figures, and at least one outlet noted that the site displayed a maintenance message in early November.
Who is affected
The notice does not say exactly who is in the 4.9 million, but the affected site is the state’s student financial aid portal, so people who have applied for or received Florida student aid are the most likely group. The department says current financial aid is not at risk, disbursements and tuition payments will not be delayed, and eligibility for scholarships, grants and student loans is unaffected. It does warn that some of its websites and online services may see temporary disruptions.
The combination of a Social Security number, name, date of birth and address is what criminals need to open accounts or file fraudulent tax returns in someone’s name, which is why this mix of data matters more than any single field.
What to do
The department recommends monitoring accounts, reviewing statements and credit reports, and considering a fraud alert or credit freeze. The steps below combine that advice with our own analysis:
- Read the department’s notice at fldoe.org/databreach and check back, since it says updates will be posted there. Questions can go to databreach@fldoe.org.
- Pull your free credit reports at AnnualCreditReport.com (or 1-877-322-8228) and look for accounts you do not recognize.
- Consider a credit freeze with Equifax, Experian and TransUnion. It is free and blocks most new-credit fraud. This is our analysis, not part of the department’s notice.
- Be wary of emails, texts or calls that mention your student aid or this breach. Criminals often follow big breaches with phishing. This is our analysis.
- Report misuse of your identity at identitytheft.gov/databreach.
What we still do not know
The department has not publicly identified who is behind the attack or how they got in, and no ransomware or leak-site claim appeared in the sources we reviewed. It has not confirmed whether all potentially exposed records were actually copied. The notice does not say whether individual notification letters will be sent or whether credit monitoring will be offered. The 4.9 million figure is a maximum (“may have”), and the department says details could change as the investigation continues.
Sources: Florida Department of Education data breach notice (accessed Nov. 3, 2026); WKMG ClickOrlando (Oct. 29, 2026); WPTV (Oct. 29, 2026); Intelligent CISO (Nov. 2, 2026); IT Nerd (Nov. 1, 2026).
Leave a Reply