What happened
The Florida Department of Education (FLDOE) says someone got unauthorized criminal access to the Florida Student Financial Aid website. Staff found it on October 19, 2026, shut it down and secured the systems. The department announced it on October 29.
FLDOE says about 4.9 million people may be affected. That site handles Florida state scholarships and grants, so the people in it are mostly current and former Florida students who applied for state aid, and in some cases their parents.
The department says the breach looks limited to the financial aid website. Current aid, tuition payments and eligibility for scholarships, grants or loans are not affected. Law enforcement (FDLE and Florida Digital Service) is investigating, and no suspect or method has been named.
What data was exposed
Per FLDOE, the info that may have been exposed includes Social Security numbers, first and last names, dates of birth, home addresses, phone numbers, email addresses and gender codes.
Not everyone had every field exposed. What was taken varies by person. FLDOE has not said anything about bank account or card data being involved.
What to do now
The SSN plus date of birth combo is the part that matters most here, because that is what people use to open credit in your name.
- 01Freeze your credit at all three bureaus: Equifax, Experian and TransUnion. It is free, it takes about 10 minutes each, and you can lift it any time you need to apply for something.
- 02Freeze for your kids too. If your child applied for state aid, they may be in this, and a minor's clean credit file is an easy target. All three bureaus let parents freeze a child's file.
- 03Get an IRS Identity Protection PIN. It stops someone from filing a fake tax return with your SSN. You can get one at IRS.gov.
- 04Watch for phishing. Your name, email, phone and address may be out there now. Expect fake financial aid or scholarship emails and texts. Log in to the real site yourself instead of tapping links.
- 05Pull your credit reports. AnnualCreditReport.com is free and shows any accounts you do not recognize.
- 06Questions go to FLDOE. The department set up databreach@fldoe.org for help.
How to check if you were in it
FLDOE says it is working on notifying people. A letter or email from them is the most reliable way to know.
Have I Been Pwned is free and the best known place to check an email against public breaches. This breach may not show up there unless the data gets leaked publicly.
OSINT Pro's email lookup checks breach records and stealer logs, which catch passwords stolen by malware on your own device.
OSINT Pro does not have the FLDOE dataset. If it ever leaks publicly and gets indexed, we will update this page.