Florida student aid site breach may expose 4.9 million people's data

Florida's Department of Education said on Thursday, 29 October 2026, that a hacker had broken into the state's student financial aid website and that personal details of about 4.9 million people may have been exposed, including Social Security numbers. The department said its staff first found the intrusion on 19 October. The website was taken offline, and a criminal investigation is under way with state law enforcement.

A Social Security number is the main identity number in the United States. It is used to open bank accounts, apply for loans and file taxes. When it leaks together with a name, date of birth and address, criminals have most of what they need to pretend to be someone else, a crime known as identity theft. Because many of the people in this database applied for aid as teenagers, some may not discover misuse for years, until they apply for their first loan or credit card.

The size of the breach is striking, although the 4.9 million figure counts people who may be affected, not people who have already suffered fraud, and it includes past applicants who may have moved away. Local reports also note it is the second large breach of a Florida government system this year, after one reported by the state's motor vehicles department.

The case is a reminder of a wider problem for education systems everywhere: they hold rich personal data on young people, often on older websites, and are a frequent target. Education departments and universities, including in India, collect similar details through scholarship and admission portals. The lesson that cyber-security experts draw from cases like this one is to keep only the data that is needed, for as long as it is needed, and to protect identity numbers with extra care.

There is also a risk after the breach itself. A cyber-security expert quoted by one Florida outlet warned that scammers may use the news to send convincing emails asking people to "update" their aid account, with links to fake websites built to steal more data. This trick is called phishing.

Short-term: Past and present aid applicants in Florida are being told to watch their bank and online accounts, check credit reports and consider a fraud alert or a credit freeze, which stops new credit being opened in a person's name. The department has set up an email address for questions about the breach.

Long-term: The investigation may lead to questions about how the website was secured and whether the state kept old applicants' data longer than needed. Large breaches in the US often lead to lawsuits and to new rules on data security for public bodies.

Who is affected: Students and former students who applied for financial aid in Florida, their families, colleges that rely on the state aid system, and anyone, including international students, whose details were entered on the portal.

Questions and Answers