Florida education dept breach exposes 4.9M aid applicants
The Florida Department of Education says a breach of its Student Financial Aid website may have exposed the Social Security numbers of about 4.9 million people.
The Florida Department of Education (FLDOE) says a breach of its Florida Student Financial Aid website may have exposed personal data — including Social Security numbers — on about 4.9 million people who applied for state aid. FLDOE disclosed the incident on October 29; it has not published a formal advisory beyond its public statement, reported by WCJB, CBS12, the Florida Phoenix, and Recorded Future News.
What was exposed
Per FLDOE, the compromised data may include:
- Names, addresses, phone numbers, and email addresses
- Gender and dates of birth
- Social Security numbers
The department stresses that not every applicant was necessarily affected and that the specific fields involved may vary by person.
Timeline
- October 19 — FLDOE becomes aware of the breach.
- October 29 — FLDOE discloses publicly, estimating ~4.9 million people potentially affected.
The department has not said when the intrusion itself occurred, and declined to characterize the nature of the incident or the attackers. No group has claimed responsibility, and FLDOE has named none.
Response and status
FLDOE took the financial aid site offline (visitors now hit a maintenance page) and says the incident is contained. It is working with the Florida Digital Service and the Florida Department of Law Enforcement, and reported the incident to the Office of the Attorney General. The department says financial aid, scholarships, grants, and student loans are not at risk and that disbursements and tuition payments will not be delayed.
As of disclosure, FLDOE had not confirmed that every potentially affected person will receive an individual notice, nor announced a free credit-monitoring program — two gaps worth tracking.
What to do today
If you applied for Florida state financial aid, assume your SSN is in scope until told otherwise:
- Freeze your credit at Equifax, Experian, and TransUnion. A freeze is free and blocks new-account fraud — the main risk when an SSN leaks.
- Watch financial accounts and credit reports for unfamiliar activity, as FLDOE advises.
- Expect SSN-themed phishing. A breach this large and this public draws impostor "notification" emails. FLDOE's contact for questions is databreach@fldoe.org; verify any message against that channel before clicking.
- Do not wait for an individual letter. With ~4.9 million records and no confirmed per-person notification yet, acting now beats waiting on the mail.
Context
State education and benefits systems keep landing on this list: they hold SSNs for millions, run on long-lived web applications, and rarely get the security budget of a bank. A 4.9-million-record SSN exposure puts this near the top of US public-sector breaches disclosed this year. The open questions — initial access vector, dwell time, whether data was exfiltrated or merely accessible — will decide how bad it really is. FLDOE has answered none of them yet.