Florida Department of Education financial aid website breach exposes data on 4.9 million people

On 29 October 2026, the Florida Department of Education (FLDOE) confirmed that criminals had gained unauthorised access to its student financial aid website, in an incident that may have exposed the personal information of approximately 4.9 million people. The department described the event as "unauthorised criminal access" to its information and said the breach was believed to be limited to the Florida Student Financial Aid website.

What was exposed

FLDOE said the potentially compromised data varied by individual but could include Social Security numbers, dates of birth, first and last names, home addresses, phone numbers, email addresses, and gender identification codes. Not everyone among the 4.9 million was necessarily affected, and the department said the specific information involved differed from person to person. The combination of names, dates of birth and Social Security numbers is particularly dangerous because it provides the core building blocks for identity theft and fraudulent account opening.

Response

The department said it had immediately activated its cybersecurity response protocols, worked to contain the incident and secure its systems, and notified law enforcement. It emphasised that current financial aid was not at risk and that the breach would not affect eligibility for scholarships, grants or student loans. Some websites and online services could be disrupted while the department restored full functionality. FLDOE directed questions to a dedicated address, databreach@fldoe.org, and urged affected individuals to monitor their financial and online accounts for suspicious activity and to review account statements regularly.

Why it matters

Student financial aid systems hold exactly the kind of long-lived identifiers — Social Security numbers and dates of birth tied to real names and addresses — that criminals prize, and the records often cover minors and young adults who are unlikely to be monitoring their credit. With nearly five million people potentially affected, the breach ranks among the larger US public-sector incidents of the year, and security specialists warned that those exposed should be alert to phishing messages posing as breach or account-update notices and should consider placing a credit freeze.