The Florida Department of Education (FLDOE) has confirmed that criminals broke into the state’s student financial aid website and may have accessed personal information on approximately 4.9 million people, including Social Security numbers and dates of birth. The department says staff became aware of the intrusion on October 19, 2026, and it made the incident public on October 29.
According to the official FLDOE data breach notice, the incident involved “unauthorized criminal access” to FloridaStudentFinancialAidSG.org, the portal run by the department’s Office of Student Financial Assistance. FLDOE says it believes the breach was limited to that website.
A portal that holds years of applicant records
The affected website is the main online hub for Florida’s state scholarship and grant programs, including the lottery-funded Bright Futures scholarship that many high school seniors apply for before college. Because students typically create accounts while still in high school, the portal likely holds records on people who applied years ago, not only current college students.
FLDOE’s notice says anyone who has “previously applied for financial aid in Florida” may be affected. The 4.9 million figure is equal to roughly 1 in 5 people living in Florida today, although some past applicants have likely since moved out of state.
Data FLDOE says may be exposed
The department lists the following information as potentially exposed:
- Social Security numbers
- First and last names
- Dates of birth
- Home addresses
- Phone numbers, including mobile numbers
- Email addresses
- Gender identification codes
FLDOE says not every individual was affected and that the specific data involved may vary by person. The combination of a name, Social Security number, date of birth and home address is enough to open credit accounts, file fraudulent tax returns or apply for loans in a victim’s name. Many of the people in the system were minors when they applied, and young people often go years without checking their credit, which can let fraud run undetected for a long time.
Ten days from discovery to disclosure
FLDOE says it activated its cybersecurity response protocols as soon as it identified the threat, stopped the unauthorized activity and secured its systems. The department notified the Office of the Attorney General under section 501.171 of the Florida Statutes, the state’s breach notification law, and is working with the Florida Digital Service and the Florida Department of Law Enforcement (FDLE). FLDOE describes the matter as an ongoing criminal investigation.
As of October 31, the financial aid portal remains offline and displays a maintenance message. FLDOE warns that other department websites and online services may also see temporary disruptions while it restores full functionality. Pasco-Hernando State College has also reposted the department’s notice to alert its students.
Financial aid payments are not affected
FLDOE says current financial aid is not at risk, and that the breach will not delay disbursements or tuition payments. The department also says the incident will not affect eligibility for scholarships, grants or student loans that it administers.
What FLDOE has not disclosed
Several key questions remain open. FLDOE has not said how the attackers got in, whether data was copied out of the system or only viewed, or which time period the affected records cover. As of publication, no ransomware or extortion group has publicly claimed responsibility for the attack, and FLDOE has not attributed the intrusion to any group.
The notice also does not mention free credit monitoring or identity protection services for affected individuals. Instead, FLDOE points people to free credit reports and fraud alerts. FLDOE had not issued any public statement on credit monitoring or the method of attack at time of publication.
Second major Florida agency breach in 2 months
The incident follows a confirmed breach at the Florida Department of Highway Safety and Motor Vehicles, which said in September that an attacker used one user’s compromised credentials to access its DAVID driver records system. BreachNews covered that case after ShinyHunters targeted the Florida DMV in an extortion claim. There is no public evidence linking the 2 incidents.
The education sector has faced a steady run of large data exposures this year, including the Frontline Education breach that exposed Social Security numbers tied to K-12 staff and students and the Instructure Canvas breach that affected schools across the U.S.
Steps for past Florida aid applicants
FLDOE recommends that anyone who has applied for Florida financial aid take these precautions:
- Monitor bank, credit and online accounts for suspicious activity.
- Pull free credit reports at
AnnualCreditReport.comor by calling 1-877-322-8228. - Consider placing a fraud alert or credit freeze with Equifax, Experian and TransUnion.
- Use the Federal Trade Commission’s resources at
identitytheft.gov/databreach. - Send questions to FLDOE at
databreach@fldoe.org.
A credit freeze is the strongest protection when a Social Security number is exposed, and it is free at all 3 bureaus. BreachNews has a step-by-step guide on how to freeze your credit after a data breach. Parents of applicants who are still under 18 can also request a freeze on a minor’s credit file.
