The Florida financial aid breach: what leaked, and what to do
Hackers got into the Florida Student Financial Aid website, and the state says Social Security numbers of up to 4.9 million past applicants may have been exposed. Your aid is safe. Your credit needs a freeze, and so does your teenager’s.
The Florida Department of Education found an intrusion into its Florida Student Financial Aid website on 19 October 2026 and announced it on 29 October. It says about 4.9 million people who applied for state aid may be affected, and the data includes names, Social Security numbers, dates of birth, home addresses, phone numbers and email addresses. Current aid is not affected. No letters or credit monitoring have been announced yet. If you or your child ever applied, freeze your credit at all three bureaus, get an IRS Identity Protection PIN and treat any message about the breach as a possible scam.
What FLDOE has said, and what is still open
The middle column is the department’s own statement. The right column is what it has not answered yet.
| Question | What FLDOE said | Still open |
|---|---|---|
| What was breached | The Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org), the state’s portal for its own scholarship and grant programs. The department believes the incident was limited to that site. | How the attackers got in. FLDOE has not said, and no group has publicly claimed the attack. |
| When | Staff became aware of the intrusion on 19 October 2026. The public statement came on 29 October. | How long the attackers had access before 19 October. |
| How many people | It “may have impacted approximately 4.9 million individuals”, and not everyone was necessarily affected. | A final count. Investigators are still confirming the scope. |
| Who | Anyone who has applied for financial aid through the site in the past. | How many years of applications the database held. |
| What data | Names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses and gender codes. The details involved may vary by person. | Whether parents’ information from applications was in the same database. |
| Your aid | Current aid is not at risk: disbursements and tuition payments will not be delayed, and eligibility for scholarships, grants and loans is not affected. | When the site comes back. FLDOE took it offline and warned other department sites may be disrupted. |
| Who is investigating | The Florida Digital Service and the Florida Department of Law Enforcement. The incident was reported to the Attorney General’s office, and a criminal investigation is open. | — |
| Letters and credit monitoring | FLDOE advises people to monitor credit reports and financial accounts. | No individual letters or free credit monitoring had been announced as of 5 November 2026. |
Sources: the FLDOE statement as quoted by The Record, SecurityWeek, CBS12 and WEAR, 29–30 October 2026. Status as of 5 November 2026. We will update this page when the department publishes a final count or starts sending letters.
1. What happened, in order
On 19 October 2026 staff at the Florida Department of Education found that an unauthorized party had got into the Florida Student Financial Aid website. The department says it started its incident response, contained the intrusion and took the site offline. On 29 October it announced the breach and its estimate of about 4.9 million people. The Florida Digital Service and the Florida Department of Law Enforcement are working on the response, the Attorney General’s office has been notified, and a criminal investigation is open. The Record, SecurityWeek, CBS12 and WEAR covered the announcement on 29 and 30 October. FLDOE has said it will post updates as the investigation confirms more.
2. Who is affected
The site is where Floridians apply for state-funded aid, so the people in it are current and former students: high school seniors applying for state scholarships, college students, and graduates who applied years ago. The department says anyone who has applied in the past could be included. It has not said how far back the records go. If a parent filled in the application for a teenager, the record is still the student’s, but the parent’s email or phone number may be on it.
3. Why you cannot look yourself up
This breach is not a list of email addresses and passwords posted online, so it will not appear in the known breach databases that checking tools search. Our checker cannot tell you whether you are in it either. Your answer will come from FLDOE, through letters or an official lookup if it sets one up. What a breach check can tell you is what else is already out there under your email. Run our free breach check to see how much a fraudster could add to a stolen Social Security number.
4. Freeze your credit, and your teenager’s
A Social Security number plus a date of birth and an address is the full kit for opening a credit card or loan in someone else’s name. A credit freeze at Equifax, Experian and TransUnion blocks that, costs nothing and can be lifted for a day when you need to apply for something yourself. Students often skip it because they have little credit. That is exactly why their numbers are attractive: misuse can sit unnoticed until the first car loan or lease application. Parents can freeze the credit of a child under 16. Our post-breach checklist has the links for each bureau.
5. Get an IRS Identity Protection PIN before tax season
Stolen Social Security numbers are used to file fake tax returns early in the year and collect the refund before the real taxpayer files. The IRS Identity Protection PIN stops that: a six-digit code that must be on any return filed under your number. Anyone who can verify their identity can get one through their IRS online account, and it renews each year. Students who are claimed as dependents can still have their own. Doing this in November means it is in place before filing opens.
6. The fake notices and calls that come next
A breach this size, with email addresses and phone numbers in it, is followed by phishing. Expect emails and texts that claim to be from FLDOE, a scholarship office or a credit monitoring company, asking you to confirm your SSN, “reactivate” your aid or pay a processing fee. Some will use your real name and school. FLDOE says your aid is not affected, so any message saying otherwise is a red flag. Check news against fldoe.org, and if a letter arrives, our guide to reading a breach notification letter shows what a genuine one contains.
7. Your address and phone number were already public
The breach added your SSN to the picture. Your home address and phone number are probably listed on people-search sites already, along with relatives’ names, and that is what makes the follow-up scams convincing: a caller who knows where you live and who your parents are sounds legitimate. Removing those listings cuts down what a fraudster can pair with the stolen data. Our guide to removing your home address covers the main sites, and Florida privacy rights explains what state law does and does not give you.
The breach took your SSN. Brokers publish the rest.
Scammers pair stolen numbers with addresses, phone numbers and relatives from people-search sites. PersProtect shows where you are exposed and files the removal requests for you. The scan is free.
Check my exposure — free →The Florida financial aid breach, answered
Was my information in the Florida financial aid data breach?
If you ever applied for state financial aid through the Florida Student Financial Aid website, assume yes. The Florida Department of Education says the breach may have affected about 4.9 million people and that anyone who applied in the past could be among them. There is no public lookup tool and no letters have been announced yet, so the safe move is to act now rather than wait to be told.
What information was exposed in the Florida Department of Education breach?
According to the department: names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses and gender codes. It says the details may differ from person to person. That combination is enough to open credit in someone’s name or file a fake tax return, which is why a credit freeze matters more here than a password change.
Does the breach affect my Bright Futures scholarship or current financial aid?
No, according to FLDOE. The department says aid disbursements and tuition payments will not be delayed and that eligibility for scholarships, grants and student loans is not affected. The financial aid website itself is offline while the investigation continues, and other department sites may have short disruptions.
Is this the same as the FAFSA?
No. The breached site is Florida’s own portal for state programs, run by the Florida Department of Education. The FAFSA is the federal application run by the U.S. Department of Education on StudentAid.gov, and nothing reported so far involves it. Many students filed both, which is why the questions get mixed up.
Will Florida offer free credit monitoring?
Nothing has been announced so far. Organizations often offer monitoring after a Social Security number breach, and it may still come. You do not need to wait for it: freezing your credit at Equifax, Experian and TransUnion is free, takes a few minutes per bureau and blocks new accounts in your name, which monitoring alone does not do.
My child applied for aid as a high school student. What should I do?
Freeze their credit too. Parents can request a freeze for a child under 16 at each of the three bureaus, and anyone 16 or older can do it for themselves. A teenager’s Social Security number with no credit history is valuable to fraudsters because misuse can go unnoticed until the first loan or apartment application years later.
I got an email about the Florida financial aid breach. Is it real?
Be suspicious of anything that asks you to confirm your Social Security number, sign up for credit monitoring through a link, or pay a fee. Breaches this large are followed by fake notices. Check any message against announcements on the official fldoe.org site, and do not reply with personal details. A genuine notice will not ask for your full SSN.
Is this connected to the Florida DMV breach?
Not as far as anyone has said. The DMV incident in September 2026 hit the DAVID driver database run by the Department of Highway Safety and Motor Vehicles and was claimed by an extortion group. The financial aid breach is a separate agency and system, and no one has claimed it. Someone who drives and applied for aid in Florida could be in both, which makes a credit freeze more urgent, not less.
You cannot change your SSN. You can make it harder to use.
See which people-search sites list your address, phone number and relatives. Free, in about a minute.
Run my free exposure scan →