I'm a few days late on this one, but it's big enough that it shouldn't slide by. The Florida Department of Education says a breach of its student financial aid website may have affected about 4.9 million people.
What Happened
According to the department's breach notice:
- The system: the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org), the main portal for state scholarships and grants, including Bright Futures.
- Discovered: October 19. The department announced it on October 29.
- Who's affected: potentially anyone who has applied for Florida financial aid, about 4.9 million people. The department notes not everyone was necessarily affected and the data varies by person.
- What was exposed: Social Security numbers, names, dates of birth, home addresses, phone numbers, email addresses and gender codes.
- How: not disclosed. The department calls it "unauthorized criminal access" and says it's working with the Florida Digital Service and the Florida Department of Law Enforcement.
The department says current aid, disbursements and eligibility aren't affected. The portal was taken offline.
Why This Matters
This is the full identity theft starter kit: SSN, date of birth and home address together. And a lot of the people in this data are young. Many applied as high school seniors, which means plenty of them have thin or no credit files and aren't checking them. That makes new-account fraud easy to commit and slow to notice.
The contact details matter too. Expect phishing that looks like it's about financial aid, scholarships or "verifying your identity after the breach." Those messages will land, because they'll be about something real.
I'll also say the uncomfortable part: the notice doesn't offer credit monitoring. It points people to the credit bureaus and the FTC and asks them to handle it themselves.
What To Do
If you, your kids, or anyone in your house applied for Florida financial aid:
- Freeze credit at all three bureaus. Equifax, Experian and TransUnion. It's free, it stops new accounts being opened in your name, and you can lift it when you need to. Do it for your college-age kids too.
- Pull your credit reports at AnnualCreditReport.com and look for accounts you don't recognize.
- Treat financial aid messages with suspicion. Don't click links in texts or emails about the breach or your aid. Go to the site directly.
- Watch for tax fraud. An SSN plus date of birth is enough to try a fraudulent return. An IRS Identity Protection PIN helps.
- Use the FTC's guidance at identitytheft.gov/databreach if something does show up.
- Questions go to databreach@fldoe.org, per the department's notice.
Bottom Line
You can't change your Social Security number, and you can't un-leak it. A credit freeze is the closest thing to a fix, and it takes ten minutes. If your family touched Florida financial aid, do it this week.
Sources: Florida Department of Education breach notice, The Record, and GovTech