The Florida Department of Education (FLDOE) has disclosed a data breach involving its student financial aid website that may have exposed the sensitive personal information of approximately 4.9 million individuals. The compromised information reportedly includes Social Security numbers, names, residential addresses, phone numbers, email addresses, genders and dates of birth.
According to the department, unauthorized criminal access to the Florida Student Financial Aid website was discovered on October 19, 2026.
The agency publicly disclosed the incident on October 29, describing it as a security breach involving unauthorized access to a system containing personal information. The exact method used to gain access and the identity of those responsible have not been disclosed.
In a statement issued by the Florida Department of Education, it was noted that individuals who had used the state's financial aid portal may have been affected by the incident.
The website facilitates the application process for scholarship, grant, and other financial assistance programs, including the lottery-funded Bright Futures scholarship program. After identifying the intrusion, the department activated its cybersecurity response procedures.
It has been determined that the unauthorized activity was stopped, contained, and the affected systems were secured.
As part of the response, the Florida Digital Service and the Florida Department of Law Enforcement are also involved, and the issue has been reported to the Attorney General's Office. According to information reported by The Record, the information exposed may pertain to nearly five million Florida students who applied for financial aid.
This incident is particularly concerning as Social Security numbers and dates of birth are included, as such information can be exploited for identity theft, fraudulent account creation, and other financial crimes. Rather than affecting the entire Florida Student Financial Aid network, the department believes that the breach was limited to the website.
Despite this, the investigation is still ongoing, and officials have not confirmed a breakdown of the affected records or explained how the unauthorized party entered the system.
The FLDOE has taken the financial aid website offline as part of the response. During the recovery process and security measures, other departmental websites and online services may experience temporary disruptions.
Although sensitive personal information was exposed in the incident, the department clarified that it did not affect the administration of financial aid.
Scholarship and grant eligibility, as well as student loan services administered by the department, are expected to continue without delay in spite of the exposure of sensitive personal information.
A warning has been issued to potentially affected individuals to monitor their financial and online accounts for unusual activity and to regularly review their credit reports.
In addition, the department recommended that students consider placing an alert or placing a credit freeze with the major credit bureaus to prevent identity fraud. Currently, the investigation has not been able to determine who is responsible for the intrusion or how the financial aid website was accessed.
No information has been provided by the Florida Department of Education as to whether the breach involved stolen credentials, exploited software vulnerabilities, or used another approach to attack.
Additionally, the authorities have not disclosed any further information concerning the nature of the intrusion, but stated that additional information will be provided once verified findings are available. The breach is not the only recent cyberattack involving government educational systems in the United States.
Separate data breaches were reported by the California Department of Education approximately one week earlier, which involved information associated with children who had been enrolled in public schools for the previous three years. Despite the lack of connection between these two incidents, the disclosures have raised concerns about the security of sensitive educational information.
This year, Florida has also experienced several security breaches relating to government organizations.
During September, the Department of Motor Vehicles reported a breach involving a prominent hacking group. According to The Record, the hackers continued to advertise the stolen DMV information on cybercriminal forums throughout October.
In a separate incident, a central Florida county experienced significant internet service disruption following an alleged cyberattack. The increasing number of incidents involving public institutions emphasizes the risks associated with large amounts of personal information stored in government databases.
A majority of educational and administrative portals maintain records containing personal information, which may make unauthorized access particularly concerning when the information relates to millions of individuals. In accordance with Florida's law requiring notification of data breaches, Section 501.171 of the state statutes requires organizations covered by the law to implement reasonable measures to protect electronic personal information.
There is generally a 30 day notification period for a breach that affects 500 or more Florida residents in order for the Department of Legal Affairs to be notified of the breach. According to applicable legal exceptions, affected individuals must also be notified as soon as possible. The incident occurs in the context of a wider increase in reported data exposures.
At least 3,43 million people were affected by 5,429 breach notification filings in the first half of 2026, according to the Privacy Rights Clearinghouse, which covered 1,969 distinct incidents. As a result, 33.8% of the reported breach incidents were unable to be determined from public filings during this period, compared with 22.6% in 2022.
There remains a priority for the Florida Department of Education in determining the extent of the exposure.
In the ongoing criminal investigation, the final number of affected individuals, the method of intrusion, and the identity of the unauthorized party are still unknown. Public-sector systems that store sensitive personal and financial information face increasing security risks as a result of this incident.
There will be a continuing need to determine how the attackers gained access to the system as well as ensuring affected individuals are given timely protection as the investigation proceeds.
.webp "Critical Linux Kernel Vulnerability Could Allow Hackers to Gain Remote Root Access")
.webp)
.jpg "Florida Reports Major Data Breach Affecting 4.9 Million Financial Aid Applicants")
.jpg)