Florida student aid breach: up to about 4.9 million people may be affected, Social Security numbers included
The Florida Department of Education announced on October 29, 2026 that unauthorised criminal access to its Florida Student Financial Aid website may have impacted about 4.9 million people; its FAQ says the compromised information includes Social Security numbers, and it urges users to monitor accounts and consider a fraud alert or credit freeze.
What happened
The Florida Department of Education (FLDOE) announced on October 29, 2026 that its Florida Student Financial Aid website, FloridaStudentFinancialAidSG.org, was hit by a data breach involving “unauthorised criminal access.” The department said its staff became aware of the incident on October 19, 2026, and that it “immediately activated its cybersecurity response protocols and took swift, decisive action to stop the unauthorised activity, contain the incident, and secure its systems.” In an update on Thursday afternoon, October 29, the department added that the hack “may have impacted approximately 4.9 million individuals.” This report is labelled POTENTIAL EXPOSURE because the department’s own wording is that those people “may have” been impacted: the count is an early estimate, the incident remains under criminal investigation, and the department says the information it has released could change as that investigation continues.
The department says it believes the breach was limited to the Florida Student Financial Aid website, although some of its websites and online services may be temporarily disrupted while it restores full functionality, and the financial aid portal still appeared to be down when the announcement was made. FLDOE notified the Florida Attorney General’s Office and is working with the Florida Department of Law Enforcement and the Florida Digital Service.
Who is affected
People who used the Florida Student Financial Aid website — the state’s main site for college scholarships and grants, including the lottery-funded Bright Futures programme, used by high school students and current college students alike. The department’s estimate is up to approximately 4.9 million individuals potentially impacted. On its frequently-asked-questions page, the department wrote that the “compromised” information in the breach was “Personal Identifiable Information including Social Security number.” Officials have not published a fuller list of the specific data types involved in the sources checked for this report, and they have not said when the unauthorised access began — only that the department became aware of it on October 19.
The department was explicit about what is not affected: students’ current financial aid is not at risk, the incident will not delay financial aid disbursements or tuition payments, and it will not affect eligibility for scholarships, grants or student loans administered by the department.
How serious
The concrete risk is identity fraud built on a Social Security number. A Social Security number is the key identifier US credit bureaus, banks and government agencies use to tell one person from another: in the wrong hands it can be used to try to open accounts in a victim’s name, file a fraudulent tax return, or pass identity checks the victim never sees. That risk does not depend on the full field list the department has yet to publish — the Social Security number alone is enough to justify the precautions below, especially for younger students who may not check their credit for years and would not notice a fraudulent account quickly. The second risk is targeted phishing: a message that claims to be about a student’s financial aid, scholarship or Bright Futures status is exactly the kind of lure the people behind a breach like this — or scammers trading on its headlines — can make convincing.
What to do now
The department recommends that users of the portal monitor their financial accounts for suspicious activity, review their account statements and credit reports, and consider placing a fraud alert or credit freeze with the major credit bureaus. Free credit reports are available through AnnualCreditReport.com, and the Federal Trade Commission’s IdentityTheft.gov carries its data-breach response guidance. Anyone with questions about this breach can contact the department at databreach@fldoe.org, and the department says it is posting updates on its data breach information page.
Treat any message about your Florida financial aid that asks you to click a link and enter personal information as suspect until you have checked it through the department’s official channels directly — type the address yourself rather than following a link in an email or text. If you have never checked whether a credit file exists in your name, this is the moment to do it: a freeze is free, reversible, and blocks new accounts opened in your name.
Sources: Government Technology (Miami Herald via Tribune Content Agency), October 29, 2026 · Tampa Bay 28 (WFTS), October 29, 2026