Florida Student Aid Data Breach: 4.9 Million People's Social Security Numbers at Risk, What Is Confirmed and What to Do This Week

The Florida Department of Education (FLDOE) says criminals broke into its Florida Student Financial Aid website, and the break-in may have exposed Social Security numbers and other personal details of about 4.9 million people who applied for state financial aid. If you, your children or your employees ever applied for Florida financial aid, those details can be used to open credit, file a fake tax return or talk a help desk into resetting an account, so act this week even if no letter arrives.

What happened in the Florida student aid data breach

This is what FLDOE has said, as quoted in reporting from GovTech, The Record and SecurityWeek:

• Discovery: Staff became aware of "unauthorized criminal access" on Monday, October 19, 2026.
• Announcement: The department went public on Thursday, October 29, saying the incident "may have impacted approximately 4.9 million individuals."
• Scope: FLDOE believes the incident was limited to the Florida Student Financial Aid website, FloridaStudentFinancialAidSG.org, the hub for state-funded scholarship and grant applications. When we tried the site on November 4 it returned a "service unavailable" error.
• Response: The department says the activity was contained. It is working with the Florida Digital Service and the Florida Department of Law Enforcement, the case is a criminal investigation, and the Attorney General's Office has been notified.
• Aid payments: FLDOE says current aid is not at risk. Disbursements, tuition payments and eligibility for scholarships, grants and loans are not affected.
• Data involved: FLDOE describes the data as "Personal Identifiable Information including Social Security number." SecurityWeek and The Record report the list as names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses and gender. FLDOE adds that not everyone was necessarily affected and the details "may vary by person."

A note on sourcing: FLDOE's own notice is at fldoe.org/databreach. That page blocked our direct requests on November 4, so the department's words above come from news reports that quote it. Those reports agree with each other. Check the official page yourself for updates, because FLDOE says the details may change as the investigation goes on.

What is not known yet

• How the attackers got in. FLDOE has not said.
• Who did it. No group had publicly claimed the attack when SecurityWeek reported on Monday, November 2. SecurityWeek also mentions a separate September breach at Florida's motor vehicle agency (FLHSMV). Neither agency has linked the two.
• How far back the records go. The department has not said which years of applicants are included.
• Whether data was copied or only viewed. Public statements describe unauthorized access, not a confirmed download.
• Whether the 4.9 million figure is final. It is an estimate.
• Individual letters and credit monitoring. None of the reports we read mention a free credit monitoring offer. Whether one comes is still unknown.

Who is affected by the Florida financial aid breach

Anyone who applied for Florida state financial aid through that website may be in the data. That includes people who have since moved out of Florida, because the records were collected when they applied. Many applicants were high school seniors at the time. Young adults often have thin or empty credit files, so fraud in their name can go unnoticed for years.

What to do this week after the Florida student aid breach

Why this breach matters for businesses

Your identity checks just got weaker. Help desks, HR teams and payroll providers often confirm who someone is with the last four digits of a Social Security number, a date of birth and a home address. If any of your staff applied for Florida aid, a stranger may now know all three. Move password resets and payroll changes to checks a stolen record cannot pass, like a callback to a known number or a passkey. We covered why recovery is now the weak point in passkey security and account recovery.

Expect convincing phishing. Real names, addresses and phone numbers make scam emails and calls far more believable. Brief staff on fake aid, tuition and "identity verification" messages. Our guide to AI phishing and fake login pages shows what these look like now.

Schools, colleges, scholarship nonprofits and their vendors have legal clocks. Florida's breach law, section 501.171, covers government bodies as well as companies. It requires notice to affected Floridians generally within 30 days, notice to the Department of Legal Affairs when 500 or more Floridians are affected, and notice to the credit bureaus when more than 1,000 people are notified at once. Vendors holding data for someone else must tell that organization within 10 days. If you run systems for an education client, know who you would call and what you would say. Recent cases like Frontline Education and Harvard's alumni systems show how often the weak point is a connected system, not the main office.

Look at what your own website collects. Any application or intake form that asks for a Social Security number becomes a target. Ask whether you need the full number, where it is stored, who can reach it, and whether old submissions get deleted. Our post on whether your website is locked covers the basics.

Florida student aid breach questions people are asking

Was my information in the Florida Department of Education data breach?

If you ever applied for Florida state financial aid through FloridaStudentFinancialAidSG.org, assume it might be. FLDOE says not every applicant was necessarily affected. Watch its data breach page for updates.

Is my Florida financial aid or Bright Futures money affected?

FLDOE says no. Current aid, disbursements, tuition payments and eligibility for state scholarships, grants and loans are not affected.

Is FLDOE offering free credit monitoring?

None of the reports we read mention an offer. You don't need one to protect yourself: credit freezes are free and work right away.

Who hacked the Florida Student Financial Aid website?

No one knows publicly. FLDOE has not named an attacker, and no group had claimed the attack as of November 2.

Should I freeze my child's credit?

If your child is under 16, yes, it is free and stays in place until you remove it. Older applicants can freeze their own credit at all three bureaus.

I moved out of Florida. Does this still apply to me?

Yes. The exposure depends on whether you applied, not where you live now.

The bigger lesson

A Social Security number can't be changed, so every database that keeps one for years becomes a target for years. Ask for less, keep it for a shorter time, and stop treating a number that strangers may know as proof of who someone is.

If you want help reviewing what your systems collect and how they verify people, see security hardening or request a quote.

Get security alerts by email, with the free checklist, at /security-alerts.

Sources: SecurityWeek, Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk; The Record, Florida warns 5 million affected by financial aid site breach; GovTech, 4.9M potentially affected by Florida student aid portal hack; Florida Statutes section 501.171; FTC, credit freezes and fraud alerts; IRS, Get an Identity Protection PIN.