Florida Department of Education Breach: 4.9 Million People’s Data at Risk

Florida’s Department of Education (FLDOE) says a breach of its Florida Student Financial Aid website, FloridaStudentFinancialAidSG.org, may have impacted approximately 4.9 million people. The notice names Social Security numbers, names, dates of birth, home addresses, phone numbers, email addresses and gender codes. A FAQ on the notice says this data may have been involved. Not every person’s record held every field; FLDOE says the specific information involved varies by person.

FLDOE says staff became aware of the unauthorized access on October 19, 2026. The notice does not name a cause. This piece leads with the count, lists what the notice says was exposed, and closes with a note on where that count comes from.

The Numbers Florida’s Education Department Reported

The breach notice centers on one figure: approximately 4.9 million people. That is the scale FLDOE gives for a single state financial aid website. FLDOE describes the incident only as “unauthorized criminal access to Department information.”

Not every one of the 4.9 million people had every field on that list exposed. FLDOE’s FAQ says the specific information involved may vary by person. A Social Security number is the one item the notice lists first among the exposed fields. The rest affect only a subset of records, by the department’s own account.

When Florida Found the Breach, and What It Has Not Said

FLDOE’s own timeline starts on October 19, 2026, the day staff found unauthorized criminal access to the financial aid site. The notice says the department activated its cybersecurity response protocols. It adds that it stopped the unauthorized activity and secured its systems.

The notice does not give a start date for the intrusion itself, only the day FLDOE noticed it. It also does not name how the intruder got in, whether a flaw was exploited, or who is behind it. The notice names no group behind the access.

FLDOE gave the required notice of the breach to the Florida Attorney General’s Office, as Florida law requires. The department is separately partnering with the Florida Digital Service and the Florida Department of Law Enforcement on its response. Its FAQ says law enforcement has been notified as part of an ongoing criminal investigation.

What Florida Says About Financial Aid Itself

FLDOE draws a clear line between the breach and the aid programs it runs. The notice says current financial aid is not at risk. It adds that the breach will not delay disbursements or tuition payments, or change eligibility for scholarships, grants or student loans.

That assurance covers the money and the paperwork, not the exposed data itself. A Social Security number taken from a state database carries risk long after a semester’s aid has been paid out. That risk is the part of this story that affects people directly.

What a Breach of This Size Means for Affected Floridians

FLDOE’s own list pairs Social Security numbers with names, dates of birth and addresses for some records. That combination is the exact one used to open new credit lines or file a fraudulent tax return in someone else’s name. Our glossary entry on what counts as a data breach covers why agencies treat Social Security numbers differently from, say, an email address alone.

FLDOE’s own FAQ advises watching accounts for unfamiliar activity and reviewing credit reports. It also suggests a fraud alert or credit freeze with the major bureaus while the investigation continues. The notice points to free credit reports at AnnualCreditReport.com and the FTC’s identitytheft.gov/databreach page. FLDOE has set up databreach@fldoe.org for questions from affected people.

Florida’s case is not the only large US education breach in recent years. Our PowerSchool data breach incident page covers a 2024 intrusion that also reached Social Security numbers tied to a US education system, in that case through a vendor. Two large education breaches in two years point to the same fact: school and state education systems hold data that pays off for an intruder.

Why a State Agency’s Own Systems Are a Target

A state financial aid portal sits where two things attackers want meet: a large population of Social Security numbers and a direct line into government infrastructure. Our government and public sector page covers the wider pattern of state and local agencies holding citizen data at a scale few private companies match. Many of these systems run on infrastructure built years apart.

Agencies running similar portals can take one lesson from Florida’s notice, regardless of how this specific intrusion happened. A breach response that separates whether the money is safe from whether the data is safe answers only half the question people are asking. FLDOE answered the first question clearly, but the notice leaves the cause and the entry point open for now.

Our data breach response guide sets out the steps an agency takes between discovery and a public notice like this one. It covers containment, notification timing, and what to tell the people affected.

Method Note: Where the 4.9 Million Figure Comes From

FLDOE publishes its breach notice at fldoe.org/databreach.stml. Every direct attempt to open that page this session returned an access denied response from the department’s content delivery network. That held for a browser style fetch and for a separate direct request alike.

We then located a capture of the same notice and its FAQ in the Internet Archive’s Wayback Machine, dated 30 October 2026, and read it directly this session. The facts above come from that capture of FLDOE’s own page, not from a news report of it. That includes the exact wording on data categories, the Attorney General notice, and the financial aid assurances. We will revisit this post if FLDOE adds a cause, an entry point, or a narrower count.