Threat intel

The Florida Department of Education (FLDOE) says an unauthorized party got into the Florida Student Financial Aid website, FloridaStudentFinancialAidSG.org, and may have exposed records for about 4.9 million people. Staff became aware of what the department calls "unauthorized criminal access" on October 19, 2026, and it went public on October 29. The records include Social Security numbers (SSNs), first and last names, dates of birth, home addresses, phone numbers, email addresses and gender codes. FLDOE says not every record holds every field.

The portal is how Florida high school and college students apply for state scholarships and grants, including the lottery-funded Bright Futures program, so the people in it are mostly young and many have thin or no credit files. That makes them easy targets for new-account fraud that can go unnoticed for years. FLDOE took the site offline, says the breach was limited to that one website, and says aid payments, tuition payments and eligibility are not affected. If you, your children or your students applied for Florida state aid, assume the record is in the stolen set until a letter says otherwise.

How it happened, as far as anyone has said

The department has not said how the attacker got in, when access started or whether data was copied out rather than only viewed. It declined to comment to The Record on the nature of the incident or the attackers, and no group has publicly claimed it. The Florida Department of Law Enforcement (FDLE) is running a criminal investigation with the Florida Digital Service, the state's IT security office, and FLDOE has notified Attorney General James Uthmeier's office.

Without a root cause, the useful thing is to know how breaches of applicant portals usually happen, because each route leaves different evidence and needs a different fix. These are the common patterns, and none of them is confirmed for this incident:

• Broken object-level authorization. The portal shows an applicant their own record at a URL or API call that carries a record ID. If the server returns whatever ID is requested without checking it belongs to the logged-in user, a script can walk through every ID and harvest the whole database one record at a time. In logs this looks like one session requesting thousands of sequential IDs.
• Injection in a search or lookup form. A field such as "find my application" that passes input into a database query without parameterising it lets an attacker run their own query and dump tables in bulk.
• Stolen staff or partner credentials. Aid portals have back-office users at the agency, at colleges and at high schools who can look up any student. One phished or reused password on an account without multi-factor authentication (MFA) gives that view to the attacker. Florida has seen this already this year: the Department of Highway Safety and Motor Vehicles (FLHSMV) said its DAVID driver database was breached in September through credentials of a single Plant City Police Department user, a breach the ShinyHunters group claimed.
• Exposed exports and admin tools. Report downloads, backup files and administrative pages that are reachable from the internet, sometimes without a login, are a frequent source of bulk leaks.

The 4.9 million figure is itself a clue to scale. A state aid portal keeps applicant records for years after the student has graduated, so the exposed set likely includes people who applied long ago and no longer think of the site. FLDOE has not said how many application years the data covers.

What affected people should do

FLDOE has not announced individual notification letters or a free credit monitoring offer, and its public advice so far is to watch accounts and credit reports and consider a fraud alert or credit freeze. Do not wait for a letter. In order:

1. Freeze credit at Equifax, Experian and TransUnion. A freeze is free under federal law, does not affect a credit score and blocks new credit opened in the person's name until it is lifted. Parents can freeze a minor's file too, which matters for applicants who were under 18 when they applied.
2. Get an IRS Identity Protection PIN. The IP PIN is a six-digit number, issued through an IRS online account, that must appear on any federal return filed under that SSN. It stops a fraudster filing a return first and taking the refund.
3. Check the free credit reports at annualcreditreport.com for accounts or inquiries you do not recognise, and repeat every few months for the next year.
4. Expect phishing that uses the breach. The leaked emails and phone numbers are enough for messages saying a scholarship is on hold or "verify your identity to keep your award". Go to FLDOE.org/databreach directly instead of clicking links in messages, and never give a full SSN to an inbound caller.

What organisations holding similar student data should do

Colleges, school districts and private scholarship programmes run the same kind of portal with the same data. The checks below cover the patterns above and can start this week.

Test authorization on every endpoint that returns an applicant record. Log in as one test applicant, capture the request for their record, change the ID to another test applicant's and confirm the server refuses it. Do the same for document downloads such as transcripts and tax forms, which are often served from a separate path that nobody reviewed.

Put MFA on every staff, counsellor and partner account that can search applicants, and prefer phishing-resistant methods (security keys or passkeys) for those that can export. Review who has search access at partner schools and remove accounts for people who have left. A school counsellor role rarely needs statewide search.

Look for the bulk pull. In web or API gateway logs, alert when one session, account or IP address requests more distinct applicant records in an hour than any real user would, and when report exports run outside office hours. Keep those logs for at least a year, because the department's own unanswered question, when access began, is the one you will need to answer after an incident.

Cut what you hold. Ask whether the portal needs the full SSN after eligibility has been verified, or whether the last four digits would do. Set a retention period for applicants who never enrolled or who graduated, and delete or archive those records offline. Every year of history kept online adds to the number in your breach notice.

Finally, check your own notification plan: who decides, which state attorney general must be told and by when, and whether a credit monitoring vendor is already under contract. FLDOE went public ten days after detection and had still not confirmed letters or monitoring when this was written; having the vendor contract in place beforehand removes that delay.

Our web penetration testing includes authorization testing of record lookups and exports like those above, and attack surface management finds the admin pages and files left reachable from the internet. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: The Record, WJHG, CBS Miami, Pineapple Report, BleepingComputer: Florida DMV breach, IRS: Get an identity protection PIN, FTC: free credit freezes.