The Florida Department of Education says a breach of its student financial aid website may have exposed the personal information, including Social Security numbers, of as many as 4.9 million people. Officials say they discovered the intrusion on Oct. 19, shut down the unauthorized activity and locked down their systems, though the incident remains under active criminal investigation.
Personal information, including Social Security numbers, of as many as 4.9 million individuals was vulnerable, according to floridaphoenix.com. The department learned about the breach of its financial aid website on Oct. 19 and is categorizing it as unauthorized criminal access, the outlet reported. The Florida Department of Law Enforcement and the Florida Digital Service are both involved in the response, according to WFTV.
What Officials Say Was and Wasn't Touched
The department says financial aid itself is not at risk, including disbursements, and it believes the incident was limited to the Florida Student Financial Aid website rather than its broader network, per the same account from floridaphoenix.com. Current financial aid disbursements, tuition payments, scholarships, grants and student loans administered by the department have not been affected, and no related delays are expected, according to WFTV. As first reported by WPEC, the department has not identified a suspect or said publicly how the intrusion occurred, and it says it will release more information as details are verified.
The department also activated its cybersecurity response protocols after discovering the breach, stopping the unauthorized activity and securing its systems, per WPEC's reporting. It says it is working with state partners to address the incident and determine its full scope, the report notes.
What Affected Floridians Can Do
People who may be affected are encouraged to monitor their financial and online accounts, review statements and credit reports, and consider placing a fraud alert or credit freeze with a credit bureau, according to WPEC. Free credit reports are available at annualcreditreport.com or by calling 1-877-322-8228, and the department has listed contact information for the three major credit bureaus along with Federal Trade Commission identity theft resources, the station reported. Anyone seeking information or assistance related to the breach can email [email protected], WFTV reported.
A Legal Clock and a Bigger Pattern
Under Florida Statutes, Section 501.171, covered entities must take reasonable measures to protect electronic data containing personal information, and a breach of security is defined as unauthorized access to that data. The law requires notification to Florida's Department of Legal Affairs within 30 days of determining a breach occurred when 500 or more residents are affected, and it requires notice to individuals as expeditiously as practicable without unreasonable delay, subject to specified exceptions.
The breach also lands amid a broader surge in large-scale data exposures. In the first half of 2026, 5,429 breach notification filings described 1,969 distinct breach events affecting at least 343 million people, according to the Privacy Rights Clearinghouse. Beyond the massive, unverified Instructure breach claim of 275 million users, the next largest reported incidents were AssuranceAmerica at 7.0 million people and Carnival Corporation at 6.0 million, the clearinghouse found. The group also reported that the cause of 33.8 percent of breach events couldn't be determined from public filings in the first half of 2026, up from 22.6 percent in 2022 — a gap that mirrors the open questions still surrounding how the intrusion into Florida's financial aid site unfolded.
