For: anyone who applied for or used Florida state student financial aid, and anyone who runs a service that holds student records. This article is based on the Florida Department of Education's official notice and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- Exact number of people
- Who among past applicants was actually affected
- How the access happened
- Whether free credit monitoring will be offered
- How individual notices will be sent
The department says the investigation is ongoing, that it remains committed to transparency, and that it will share more information as verified details become available.
What to do today
Check your free credit reports
You can get free credit reports at annualcreditreport.com or by phone at 1-877-322-8228, as listed in the department's notice. Look for accounts, loans or addresses you do not recognize.
Consider a fraud alert or a credit freeze
The department suggests considering a fraud alert or credit freeze with the major credit bureaus (Equifax, Experian and TransUnion). A freeze makes it harder for someone to open new credit in your name using your Social Security number. You can lift it when you need to apply for credit yourself.
Watch accounts and statements
The department asks people to monitor financial and online accounts for suspicious activity and to review account statements and credit reports regularly. Keep doing this for a long time, not only this month, because a Social Security number does not expire.
Be wary of anyone who mentions this breach
Names, email addresses and phone numbers (including mobile numbers) may be exposed, so a scam message can use your correct details. A message that knows them is not proof that it is genuine. Do not open links or call numbers in an email, text or call that mentions the breach, financial aid or "verification". Type fldoe.org/databreach into your browser yourself.
Never give your Social Security number, password or bank details to someone who contacted you first. See What is phishing?
Ask the department, and use the FTC's guidance
The department gives databreach@fldoe.org as a dedicated contact for questions and fldoe.org/databreach for updates. The US Federal Trade Commission has general identity-theft guidance at identitytheft.gov/databreach, which the department's notice also lists. That page is general advice for any breach, not a statement about this one.
What happened (from the department's announcement)
Everything below is as stated in the department's notice at fldoe.org/databreach.stml, checked on October 30, 2026.
Oct 19, 2026
Department staff became aware of the incident: unauthorized criminal access to Department information.After discovery
The department says it activated its cybersecurity response protocols to stop the activity, contain the incident and secure its systems. It gave notice to the Office of the Attorney General pursuant to section 501.171, Florida Statutes, notified law enforcement, and is partnering with the Florida Digital Service and the Florida Department of Law Enforcement. A criminal investigation is ongoing.Oct 29
The department announced the incident publicly. It says certain websites and online services may experience temporary disruptions.
- System
- Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org)
- Who
- May have affected approximately 4.9 million individuals; anyone who previously applied for financial aid in Florida may have been affected
- Items
- May include Social Security numbers, first and last names, dates of birth, home addresses, phone numbers (including mobile numbers), email addresses and gender identification codes (M or F); not all individuals were necessarily affected, and the information may vary by person
- Scope
- The department believes the incident was limited to the Florida Student Financial Aid website
- Cause
- Described as unauthorized criminal access; how it happened has not been published
- Financial aid
- Current aid not at risk; disbursements, tuition payments, and eligibility for state scholarships, grants and student loans not affected
- Authorities
- Office of the Attorney General notified (section 501.171, F.S.); law enforcement notified, criminal investigation ongoing; partnering with the Florida Digital Service and the Florida Department of Law Enforcement
What is known and what is not
Status as of October 30, 2026. When the department publishes more, we will update the status column.
| Item | What the department says | Status |
|---|---|---|
| Affected system | Florida Student Financial Aid website | Confirmed (department) |
| Date of discovery | October 19, 2026 | Confirmed (department) |
| Number of people | May have impacted approximately 4.9 million individuals | Possible (department) |
| Who is affected | If you previously applied for financial aid in Florida, your information may have been affected; not all individuals were necessarily affected | Possible (department) |
| Social Security numbers | May be among the information exposed | Possible (department) |
| Names, dates of birth, home addresses | May be exposed | Possible (department) |
| Phone numbers (including mobile), email addresses | May be exposed | Possible (department) |
| Gender identification codes (M or F) | May be exposed | Possible (department) |
| Passwords, card or bank data | Not listed in the notice | Not stated |
| Other systems | Department believes the incident was limited to the financial aid website | Possible scope (department's belief) |
| Cause | Called unauthorized criminal access to Department information; method not published | Under investigation |
| Financial aid and tuition payments | Not at risk or delayed | Confirmed (department) |
| Misuse of the data | Not mentioned in the notice | Not stated |
| Free credit monitoring | Not mentioned in the notice | Not stated |
| Individual notices | Not described in the notice | Not stated |
| Law enforcement | Notified; ongoing criminal investigation | Confirmed (department) |
How to read it: 'may have affected' is not the same as 'confirmed'
The department says about 4.9 million people may have been affected, and that not all individuals were necessarily affected. Treat the number as a possible figure that can change. Also, the aid itself is safe according to the department, but that does not tell you whether your Social Security number is safe.
What a Social Security number can be used for
In general, a Social Security number combined with a name and date of birth is what many lenders and agencies use to identify a person, and names with email addresses and phone numbers make scam messages look genuine. When such data is exposed, it can be misused as described below. This does not mean it has happened in this case.
- Opening new credit accounts or loans in someone else's name, which is what a credit freeze is meant to block
- Filing a false tax return to claim a refund
- Emails, texts and calls that use your correct name, email address or phone number and claim to be from a school, a lender or a government office
- Unlike a password, the number cannot simply be changed, so the risk can last for years
Florida Student Financial Aid website
Unauthorized criminal access (department)
↓
Information that may be exposed
SSN, name, date of birth, address, phone, email, gender code (not everyone necessarily affected)
↓
What affected people do
Check credit reports, consider a fraud alert or freeze, watch accounts, distrust messages that mention the breach
For those who run student or aid systems
The department has not said how the access happened, so this section uses only what it has disclosed.
Hold fewer sensitive fields in web-facing systems
The announcement shows that one web-facing system can hold the personal data of millions of people. Review whether a portal needs to store full Social Security numbers at all, or whether a partial value or a token would do, and how long records are kept after they are no longer needed.
Decide in advance what each public website can reach
The department believes the incident was limited to one website. Knowing what each web-facing system can reach, and logging large reads from the record store, helps you say quickly what was and was not touched (background: Rate limiting and abuse control).
Prepare the notice before you need it
The department had to notify the state attorney general and tell millions of people. Have a list of data items per system, a way to reach affected people, and a place for updates ready before an incident.
Sources (public record)
The primary source is the department's own notice. Automated requests to that page return "403 Access Denied", so our editor read it in a browser on October 30, 2026. The news reports below do not contradict it on the main points and are secondary. We have not speculated on anything they do not say.
-
Florida Department of Education, data breach notice (checked October 30, 2026) — fldoe.org
-
CBS News Miami, Hackers breached Florida's Department of Education financial aid website, officials confirm (October 29, 2026) — cbsnews.com
-
WKMG ClickOrlando, Hack of Florida Department of Education exposes student Social Security numbers (October 29, 2026) — clickorlando.com
-
FOX 13 Tampa Bay, Florida Department of Education warns of data breach affecting nearly 5 million people (October 29, 2026) — fox13news.com
Update history
2026-10-30: First version, based on the department's own notice, with three news reports as secondary sources. We will update this article when the department publishes new facts.
Read next
- Follow-on scams: What is phishing?
- Another education-sector breach: The LMU Munich student data breach
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)