What the Florida Department of Education disclosed

Hackers accessed the Florida Student Financial Aid website, and the Florida Department of Education says the intrusion may have exposed Social Security numbers and other personal data for about 4.9 million people. The department announced the breach on Thursday, Oct. 29, 2026, the same day it was reported, so the numbers are early and could change.

Staff first learned of unauthorized access on Oct. 19 and traced it to the financial aid website, according to the department's notice as reported by CBS12. The notice came ten days after that discovery. The department says the incident appears limited to FloridaStudentFinancialAidSG.org. "At this time, we believe the incident was limited to the Florida Student Financial Aid website," the department said in its breach statement, as quoted by ClickOrlando.

After discovering the activity, the department activated its cybersecurity response protocols, stopped it, secured its systems and notified the Florida Attorney General's Office. The Florida Department of Law Enforcement and the Florida Digital Service are assisting, and the department describes the matter as an active criminal investigation. Some department websites and online services may be temporarily disrupted while it restores full functionality.

Which data may have been exposed

The department specifically named Social Security numbers as part of the compromised personal identifying information. That detail raises the stakes. A bank card can be reissued, but a Social Security number stays the same for life, so a leaked one can be used for years to open accounts or file a fraudulent tax return in someone else's name.

The department also says current financial aid, tuition payments, and eligibility for scholarships, grants, and student loans will not be affected. Families paying tuition this semester can take some comfort there. That answer says nothing about identity theft, though, and the identity risk is the part that lasts.

The people most likely to be affected are students, parents, and others who used the financial aid site. The department describes 4.9 million as the number of people possibly affected, which means not every person in that count is confirmed to have had data taken.

Why the 4.9 million figure is still an estimate

Most early coverage, including WCTV's report, frames 4.9 million as people possibly impacted. The department has said the full scope is still being determined, as Tallahassee Phoenix reported. The final count may rise or fall.

Almost all of the reporting so far draws on the department's own notice. That means independent confirmation of the scale, the data fields and the attacker's activity is limited. Treat the number as the state's estimate until it publishes more detail.

How this compares with the Florida DMV hack

This is a separate incident from the Florida DMV breach. The Florida Department of Highway Safety and Motor Vehicles said in September that it had been hacked, making it the second organization holding Americans' driver's license data to be hit that month, according to NBC News.

The DMV case has been linked to ShinyHunters. The agency said in October that a September 4 breach used credentials a local law-enforcement employee had improperly stored on a personal device, as reported by Slashdot, citing Ars Technica. The department of education has not named a suspect, so no link to ShinyHunters or any other group has been established for this case. For more on the group, see USA 24's report on a federal suspicion that a U.S. firm executive helped run a ShinyHunters extortion site.

Taken together, two Florida agencies that hold sensitive personal records have now disclosed intrusions this fall. A third claim is also in circulation, but it is unverified. A hacker said it had taken records on nearly 500,000 people from the Florida Department of State, and the state had not addressed it when TechRadar reported it. Nothing reported so far connects that claim to the education breach.

School-linked systems have seen similar exposure elsewhere. USA 24 covered the Frontline Education data breach, which exposed staff Social Security numbers and student records.

What affected people should do now

The department's own guidance points to a short list of steps:

  • Email [email protected] if you think you are affected.
  • Monitor bank, credit card and other financial and online accounts, and review statements for charges you do not recognize.
  • Pull free credit reports at AnnualCreditReport.com.
  • Consider a fraud alert or a credit freeze. The department lists these credit bureau numbers: Equifax 1-800-525-6285, Experian 1-888-397-3742, and TransUnion 1-800-680-7289.
  • Be skeptical of calls, texts, or emails that mention financial aid, tuition, or scholarships, especially if they ask for a Social Security number or bank details. This is general guidance, not a finding from the department.

A credit freeze blocks most new credit from being opened in your name. You will need to lift it before applying for a loan or a new card, so plan for that step.

What the state has not said yet

The department has not named a suspect or explained how the intrusion happened. It has not said how long the attackers had access, what data fields beyond Social Security numbers were exposed, or whether the data has been posted for sale or leaked.

Those gaps matter. A stolen name and Social Security number carries a different risk than a file that also includes bank details, and the state has not said which fields were involved. Families who want a clear answer will need the department's full notice and later updates from the investigation.

What to watch next

Three things will show how serious this breach becomes. The first is whether the department revises the 4.9 million estimate once its review is complete. The second is whether the Florida Attorney General's Office, which the department has notified, says anything publicly. The third is whether the stolen data appears on leak sites or in sale listings.

Restoration of the disrupted websites and online services is a near-term signal as well. The criminal investigation has no timeline in the reporting so far, and that means families may be waiting for answers for some time. The most useful steps for now are to check accounts, decide on a credit freeze and contact the department if you used the site. The answers that matter most, including whether anyone's Social Security number is being used, will come from the department's next notice rather than the first headlines.