Florida Financial Aid Breach Exposes 4.9 Million SSNs

The target was the state's own Florida Student Financial Aid website, where Florida high school seniors register to qualify for Bright Futures and other state scholarships and grants. A Social Security number cannot be changed, and many of the people in this system have never opened a credit account.

Key Takeaways

• The Florida Department of Education (FLDOE) says a breach of its Florida Student Financial Aid website may have impacted approximately 4.9 million individuals.
• FLDOE staff learned of the intrusion on October 19, 2026, and the department disclosed it publicly on October 29.
• Exposed fields include Social Security numbers, names, dates of birth, home addresses, phone numbers, email addresses and gender codes.
• FLDOE says financial aid disbursements, tuition payments and scholarship, grant and loan eligibility are not affected.
• Coverage through October 30 mentions no free credit monitoring, so families are being told to freeze credit and watch their accounts themselves.

What Happened at the Florida Department of Education?

FLDOE says its staff became aware on October 19 of "unauthorized criminal access to the financial aid website," according to CBS Miami. The department says it "took swift, decisive action to stop the unauthorized activity" and published a statement ten days later, on Thursday, October 29.

The affected system is FloridaStudentFinancialAidSG.org. FLDOE told News 6 in Orlando that "At this time, we believe the incident was limited to the Florida Student Financial Aid website." The Record reports that "FLDOE has taken the financial aid site down," that the incident "has been contained," and that it was reported to the Office of the Attorney General. The Florida Digital Service and the Florida Department of Law Enforcement are assisting.

For security teams, the useful facts are missing. FLDOE declined to tell The Record how the attackers got in or who they are. No group has publicly claimed the data, no vendor has been named, and the department has not said how long the attackers were inside before October 19.

What Data Was Exposed?

According to WCTV, the exposed personal information includes:

• Social Security numbers
• First and last names and dates of birth
• Home addresses and phone numbers
• Email addresses
• Gender identification codes

Some outlets round to "nearly 5 million," but FLDOE says approximately 4.9 million and hedges with "may have impacted." In September, ShinyHunters claimed about 200,000 driver records from the Florida DMV's DAVID database. The financial aid leak is roughly 24 times that size, and nearly four times the 1.3 million SSNs copied in the Arizona courts phishing breach.

Why Are Student Social Security Numbers So Valuable?

Student SSNs are valuable because most students have no credit history, so nobody notices when a criminal starts building one. Florida seniors file the Florida Financial Aid Application in their final year of high school. For the Class of 2027, one St. Johns County high school tells students they "must submit an error-free FFAA between October 1, 2026, and August 31, 2027" on the state aid site. FLDOE found the breach 18 days into that window. Many seniors are still 17 when they file, with no credit file of their own.

That matters for three kinds of fraud:

• Synthetic identity fraud. Criminals pair a real SSN with a made up name and build credit on it. A Federal Reserve synthetic identity toolkit says fraudsters favor SSNs of people without an active credit profile, "such as the elderly, the incarcerated and (most commonly) children."
• Student aid fraud. In June 2025, Federal Student Aid warned colleges that "the rate of fraud through stolen identities has reached a level that imperils the federal student aid programs," in an electronic announcement that added identity checks for some first time applicants. A full record with name, birth date, SSN and address is what those rings need.
• Tax refund fraud. A dependent's SSN can be used to file a fake return or claim the student on someone else's return. Borrower SSNs from the Navient law firm breach carry the same risk.

What This Means for Your Inbox

Most coverage stops at the SSNs. The email addresses are the part that arrives first. Florida's breach notification law, section 501.171, applies its notice rules to government entities and lets them notify people by email at "the e-mail address of the individual in the records of the covered entity." Those are the same addresses the attackers now hold. The real notice and the fake ones can land in the same inbox in the same week.

The same law sets individual notice "no later than 30 days after the determination of a breach or reason to believe a breach occurred," with exceptions for law enforcement delays. Counted from October 19, that points to mid November. Expect these lures before and after it:

• Fake breach notices asking you to "verify" your SSN or enroll in credit monitoring through a link. FLDOE had not announced any monitoring offer in the coverage we reviewed.
• Bright Futures or grant problems claiming your award is on hold until you log in. FLDOE says eligibility is not affected.
• FAFSA and IRS impersonation using your real birth date and address to look official.
• Texts and calls, because phone numbers leaked too.

In Gmail, open the arrow under the sender's name and check the mailed by and signed by lines. Google's guide to avoiding phishing emails explains the warnings it shows. The safest rule is simpler: reach FLDOE only through FLDOE.org/databreach or databreach@fldoe.org, typed by hand.

What Should Affected Floridians Do Now?

FLDOE recommends "considering placing a fraud alert or credit freeze with the major credit bureaus." A freeze is the stronger option, and it costs nothing. If you or your child applied for Florida state aid, work through this list:

1. Freeze credit at all three bureaus. The FTC says you must contact Equifax, Experian and TransUnion separately. Parents can request a free freeze for a child under 16.
2. Get an IRS Identity Protection PIN. The IRS calls it "a six-digit number that prevents someone else from filing a tax return using your Social Security number." Parents can request one for dependents, but anyone under 18 must use an alternative to the online tool. The IRS also warns: "Phone calls, emails or texts asking for your IP PIN are scams."
3. Pull your free credit reports at AnnualCreditReport.com or 1-877-322-8228 and look for accounts you did not open.
4. Lock down the email address on your aid account with a unique password and two step verification.

What Should Compliance Teams Watch Next?

This is the second Florida agency breach in seven weeks with the same script: an Attorney General notice, state investigators, and no detail on the entry point. The DMV data is still circulating; The Record reports that "Members of the group have continued to offer the stolen DMV data for sale on cybercriminal forums throughout October." Section 501.171 also requires notice to the nationwide consumer reporting agencies when more than 1,000 people are affected. Two questions stay open: how long the attackers were inside before October 19, and how many years of applicants the site held. Until then, the freeze is the one control families fully own.