Florida Financial Aid Website Breach May Have Exposed 4.9 Million

Anyone who has applied for student financial aid in Florida should consider freezing their credit now: the Florida financial aid breach disclosed on 29 October may have exposed Social Security numbers and dates of birth for about 4.9 million people, according to the Florida Department of Education (FLDOE).

The department says criminals gained unauthorised access to its Florida Student Financial Aid website, FloridaStudentFinancialAidSG.org. Staff became aware of the breach on 19 October. FLDOE says it believes the incident was limited to that website, and that “Not all individuals were necessarily affected”, with the information involved varying from person to person.

What to do after the Florida financial aid breach

FLDOE’s own advice is to monitor financial and online accounts, review statements and credit reports regularly, and consider a fraud alert or credit freeze with the major credit bureaus. It points people to the Federal Trade Commission’s breach guidance at identitytheft.gov/databreach.

• Freeze your credit. A credit freeze stops anyone, including you, from opening new credit in your name until you lift it. The FTC says it is free, does not affect your credit score and lasts until you remove it. You need to contact all three bureaus: Equifax, Experian and TransUnion.
• Or add a fraud alert. A fraud alert tells lenders to verify your identity before granting new credit. It is free, lasts one year, and you only need to contact one bureau, which must tell the other two.
• Check your credit reports. Free reports are available at AnnualCreditReport.com or on 1-877-322-8228, FLDOE says.
• Think about younger applicants. Federal law lets parents freeze the credit of children under 16 for free, the FTC says. A Social Security number with no credit history attached is attractive for fraud.
• Be wary of contact about the breach. Names, emails, phone numbers and addresses are on the list of possibly exposed data, which makes convincing phishing messages easier to write. FLDOE’s stated contact for questions is [email protected].

FLDOE says current financial aid is not at risk, the incident will not delay aid disbursements or tuition payments, and it will not affect eligibility for scholarships, grants or student loans from the department.

What FLDOE has confirmed about the breach

On the Florida financial aid breach itself, the department’s data breach page lists the information that “may include” Social Security numbers, first and last names, dates of birth, home addresses, phone numbers including mobile numbers, email addresses and gender identification codes (M or F). Its FAQ says that if you have previously applied for financial aid in Florida, your information may have been affected.

FLDOE says it activated its cybersecurity response protocols when it identified the threat, stopped the unauthorised activity, contained the incident and secured its systems. It has given the required notice to the Office of the Attorney General under section 501.171 of the Florida Statutes, and is working with the Florida Digital Service and the Florida Department of Law Enforcement. It describes the case as an ongoing criminal investigation.

The department posted the same notice on its verified X account, @EducationFL, on 29 October, followed by a list of precautions. It warned that some of its websites and online services may see temporary disruptions during the response. It has not said who was responsible or how access was gained, and The Record reports that the department declined to comment on the nature of the incident or the attackers.

Other education and state breaches this autumn

According to The Record, the Florida disclosure came a week after California’s education department announced a breach involving all children enrolled in the state’s public school system over the last three years, and it is the second large Florida government breach this year after the state’s Department of Motor Vehicles reported one last month. Neither was mentioned in FLDOE’s statements.

Earlier this month, TSN reported that hackers copied California student data from a state testing contractor’s server. School software provider Frontline Education has also said an August breach exposed Social Security, Medicaid and student ID numbers. Outside education, Citizens Bank said a breach exposed customers’ Social Security numbers and birth dates.

Why 4.9 million is a ceiling, not a count

The 4.9 million figure in the Florida financial aid breach is worth reading carefully. FLDOE’s wording is that the breach “may have impacted approximately” that many people, and it adds that not everyone was necessarily affected and that the data involved varies by person. That makes it closer to the size of the population whose records sat behind the website than a confirmed tally of people whose Social Security numbers were taken. Until the department narrows it, every past applicant has to treat themselves as exposed.

That uncertainty is why, for anyone caught up in the Florida financial aid breach, a credit freeze is the sensible default rather than an overreaction. A name, date of birth and Social Security number together are the core of new-account fraud, and unlike a password they cannot be changed. A freeze costs nothing and blocks the most damaging use of that combination, while monitoring only shows the damage after it happens.

The other open question is notification. FLDOE’s public page does not say whether individual letters or emails will follow, or whether free credit monitoring will be offered. Florida’s breach law requires notice to affected individuals within 30 days of determining a breach unless law enforcement asks for a delay, and it allows a website and media notice instead where more than 500,000 people are affected. With the department describing this as an ongoing criminal investigation, applicants may not get a personal letter soon, which is another reason to act on the public notice rather than wait for one.

Sources

Primary:

• Florida Department of Education, “Data Breach” page and FAQ: https://www.fldoe.org/databreach
• Florida Department of Education on X (@EducationFL), 29 October 2026: https://x.com/EducationFL/status/2115821380356763776 and https://x.com/EducationFL/status/2115853444376416610
• Florida Department of Education press release, “Florida Department of Education is Aware of a Data Breach Incident Involving Unauthorized Criminal Access to Department Information”, 29 October 2026: https://www.fldoe.org/newsroom/latest-news/
• Federal Trade Commission, “Credit Freezes and Fraud Alerts”: https://consumer.ftc.gov/articles/credit-freezes-and-fraud-alerts
• Florida Statutes, section 501.171: http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html

Press:

• The Record, Jonathan Greig, “Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach”, 30 October 2026: https://therecord.media/florida-warns-5-million-affected-financial-aid-site-breach

Related stories

• Hackers Copied California Student Data From a State Testing Contractor’s Server
• Frontline Education Says Student IDs Taken in August School Breach
• Citizens Bank Says a Breach Exposed Customers’ Social Security Numbers