Florida financial aid site breach: up to 4.9 million affected

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

The Florida Department of Education says an unauthorized party accessed the state's student financial aid website and that up to 4.9 million people may be affected. Social Security numbers are among the personal data involved. The department says current aid, scholarship and grant payments are not affected, and it recommends that people watch their financial accounts and consider a fraud alert or credit freeze.

What happened

Department staff found the intrusion on October 19, 2026, on the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org). The department announced the incident on October 29, 2026, in a notice on its data breach information page. The notice says: "At this time, we believe the incident was limited to the Florida Student Financial Aid website and may have impacted approximately 4.9 million individuals." The site is the state's main portal for college scholarships and grants, including the lottery-funded Bright Futures program.

The department has notified the Florida Attorney General's office and is working with the Florida Digital Service and the Florida Department of Law Enforcement, which is running a criminal investigation. The department has not named a suspect or said how the access happened.

The 4.9 million figure is an estimate of people who may be affected. The department has not said that every one of them had data taken, and it has not said how many records were actually copied.

What data was involved

These facts come from the department's own notice, which is linked below, and match the coverage in several Florida news outlets.

• Social Security numbers: Confirmed, department notice. Every outlet that covered the announcement also lists them.
• Other personal data: Confirmed as varying by person. The department says the types of personal data involved may differ from one person to another. It has not published a full list of fields, so this page does not assume that names, addresses or dates of birth were included.
• Aid payments and eligibility: Confirmed as not affected. The department says disbursements, tuition payments and eligibility for scholarships, grants and loans should continue as normal, though the website may see disruptions during the response.

Anyone who has applied for or received Florida state financial aid through this website could be in the affected group. That includes students and, in some cases, their families.

What you can do now

A Social Security number cannot be changed, so the most useful steps are the ones that make it harder to open new accounts in your name.

1. Place a credit freeze. A freeze with Equifax, Experian and TransUnion stops most new credit from being opened in your name. It is free, and you can lift it when you need to apply for credit. Parents can also request a freeze for a child under 18 at each bureau.
2. Or add a fraud alert. A fraud alert asks lenders to verify your identity before opening an account. Placing one at a single bureau notifies the other two.
3. Check your credit reports. Look for accounts, inquiries or addresses you do not recognize. Free weekly reports are available at AnnualCreditReport.com.
4. Consider an IRS Identity Protection PIN. An IP PIN helps block a fraudulent tax return filed with your Social Security number. You can request one through your IRS online account.
5. Treat aid-related messages with care. Expect scam emails, texts and calls that mention Bright Futures, financial aid or this incident. Do not share account details or codes through a link in a message. Go to the official site yourself.
6. Use the department's channels for questions. The department is posting updates on its data breach information page and takes questions at databreach@fldoe.org.

If you later receive a notice letter, it should say which of your data was involved. That can help you decide whether you need more steps, such as watching bank accounts or replacing a government ID.