← Artículos y guías sobre fraude, ciberseguridad, privacidad y PLD

Florida financial aid breach exposes 4.9M SSNs: what to do

Florida's student financial aid site breach may have exposed SSNs, names and addresses of 4.9 million people. What leaked and how to freeze your credit.

2026-11-02

The Florida Department of Education (FLDOE) says criminals gained unauthorized access to the state's student financial aid website, FloridaStudentFinancialAidSG.org. According to the official breach notice, up to 4.9 million people may have had personal data exposed, including Social Security numbers.

What happened?

FLDOE says it became aware of the breach on October 19. It disclosed the incident publicly the following week, as reported by The Record, and took the financial aid site offline. The department says it stopped the unauthorized activity, contained the incident and that the breach appears limited to that website. Law enforcement is investigating, with the Florida Digital Service and the Florida Department of Law Enforcement. FLDOE has not said who was behind it, and no group had claimed responsibility at the time of The Record's report.

What data was exposed?

Data	Main risk
Social Security number	New credit, accounts and tax returns in your name
Name and date of birth	Complete a synthetic-identity kit when combined with the SSN
Home address	Mail fraud and intercepted cards
Phone (including mobile) and email	Phishing, smishing and SIM-swap attempts
Gender code (M/F)	Makes social-engineering pitches more convincing

FLDOE says current aid is not at risk: disbursements and tuition payments will not be delayed, and eligibility for scholarships, grants and student loans is unaffected.

What does Florida law require?

FLDOE says it notified the Attorney General's office under section 501.171, Florida Statutes, which also covers government agencies. The law requires notice to the state within 30 days when 500 or more Floridians are affected, notice to individuals within 30 days of determining the breach, and notice to the nationwide credit bureaus when more than 1,000 people must be notified at once. See our US regulation guide and the state privacy law map.

My SSN may be exposed: what should I do?

Freeze your credit at Equifax, Experian and TransUnion. The FTC notes a freeze is free, does not affect your score, and must be placed at each bureau.
Or place a fraud alert: it lasts one year, is renewable, and one bureau must tell the other two.
Check your credit reports for free at AnnualCreditReport.com.
Get an IRS IP PIN. The six-digit code blocks others from filing a tax return with your SSN; per the IRS, anyone with an SSN or ITIN who can verify their identity can get one, and it changes every year.
Treat breach-related calls and texts as suspect. FLDOE lists only an email contact (databreach@fldoe.org). Never share your SSN through a link or an unsolicited call.
Report misuse at IdentityTheft.gov to get a recovery plan.

More detail in our guide to identity theft in the US: IdentityTheft.gov, credit freezes and the IP PIN.

Why is student data so valuable?

Aid databases hold SSNs, birth dates and current contact details, often for young people with thin credit files who rarely check their reports, which makes synthetic-identity fraud easier to hide. Student aid is also a direct fraud target: the same week the Justice Department charged five people in a “ghost student” scheme. There is no known link between the two cases.

This is Florida's second large government breach this year: The Record notes the state's DMV reported a breach in September, with stolen data offered on criminal forums in October. FLDOE has not said how attackers got in or whether everyone counted in the 4.9 million figure had data copied. We track updates on the Cyber Target Radar.