Hackers breached Florida’s student financial aid website, putting the personal data of roughly 4.9 million people at risk. Here’s what happened, what was exposed, and the two things every past applicant should do today.
▶ Watch the 40-second CoreRecon breakdown of the Florida student aid breach.
What happened to Florida’s student aid website?
An unauthorized party gained access to the system behind the Florida Student Financial Aid website, the portal Floridians use to apply for state scholarships and grants. FLDOE says it became aware of the intrusion on October 19, 2026, took the financial aid site offline, and reports that the incident is now contained. The department is working with the Florida Digital Service and the Florida Department of Law Enforcement, and has reported the incident to the Office of the Attorney General.
What data was exposed?
According to FLDOE, the information that may have been accessed includes:
- Full names
- Social Security numbers
- Dates of birth
- Home addresses
- Phone numbers
- Email addresses
- Gender
That combination is exactly what criminals need to open new credit lines, file fraudulent tax returns, or run convincing phishing scams. A Social Security number doesn’t expire, so the risk from this kind of exposure can last for years, not weeks.
Who is affected?
Anyone who has ever applied for Florida state financial aid could be affected. That includes current students, recent graduates, and adults who applied years ago and may have forgotten about it. Parents who helped children apply should check as well.
Who is behind the attack?
So far, no group has claimed responsibility, and FLDOE has declined to discuss the nature of the attack. That silence matters: when stolen data isn’t publicly claimed, it may be quietly sold or used in targeted fraud. Assume your information is in criminal hands and act accordingly.
A pattern, not a one-off
This breach follows a September breach of Florida’s driver database, and stolen DMV data has reportedly been offered for sale on cybercrime forums since. Two large state-agency breaches in one season is a reminder that public-sector systems holding millions of records are high-value targets, and that the data you hand to any agency is only as safe as its security program.
What to do right now
If you, your child or anyone in your household has applied for Florida financial aid, take these steps today:
Freeze your credit
Place a free freeze with all three bureaus (Equifax, Experian and TransUnion). It stops new accounts from being opened in your name and takes about 10 minutes.
Watch for phishing
Expect emails, texts and calls about “your financial aid” or “breach compensation.” Never click links or share info; go directly to fldoe.org instead.
Monitor your accounts
Review bank statements and pull your free credit reports at AnnualCreditReport.com. Report anything you don’t recognize right away.
Get an IRS IP PIN
An Identity Protection PIN from the IRS blocks anyone else from filing a tax return with your Social Security number.
What this means for organizations
Schools, counties, healthcare providers and businesses hold the same kinds of data that were exposed here. The lessons are the same at every size:
- Know where sensitive data lives and limit who and what can reach it.
- Test before attackers do with regular penetration tests and vulnerability assessments of public-facing portals.
- Watch 24/7. Intrusions are often found weeks after they start. Continuous SOC monitoring shortens that window.
- Have an incident response plan ready before you need it, including who to call and how to notify the people affected.
Is your organization next?
CoreRecon is a veteran-owned cybersecurity company with 24/7 SOC operations in Texas. We help schools, governments, healthcare and businesses find gaps before attackers do. No ticket queues: call and talk to an engineer right away.
Get a Free Security AssessmentBreach Prevention ServicesFrequently asked questions
Was my information exposed in the Florida student aid breach?
If you’ve ever applied for Florida state financial aid, your information may be included. Check FLDOE’s official updates at fldoe.org and watch for a notification letter.
Will my financial aid or scholarship payments be delayed?
No. FLDOE says existing aid is safe and disbursements, tuition payments, scholarships, grants and student loans are not affected.
Does freezing my credit hurt my credit score?
No. A credit freeze is free, doesn’t affect your score, and can be lifted temporarily whenever you need to apply for credit.
Who hacked the Florida Department of Education?
As of this writing, no group has claimed the attack and FLDOE has not identified the attacker.
Stay alert. Stay safe. Official updates are available from the Florida Department of Education at fldoe.org.