Florida Education Department says financial aid site breach may affect about 4.9 million people

The Florida Department of Education says a breach of its student financial aid website may affect “approximately 4.9 million individuals,” according to a notice the department had online as of Oct. 31. The notice says staff learned on Oct. 19 of “unauthorized criminal access” to department information and that the incident is believed to be limited to the Florida Student Financial Aid website, FloridaStudentFinancialAidSG.org.¹

The department made the breach public Thursday, Oct. 29, WPTV reported.² As of Oct. 31, its notice lists email as the way to reach the department with questions, does not mention free credit or identity monitoring and does not say whether the department will mail letters to the people involved.¹

What may have been exposed

According to the notice, the information potentially involved includes Social Security numbers, first and last names, dates of birth, home addresses, phone numbers, email addresses and gender codes. The department says not everyone was affected and that the data involved differs from person to person.¹ Its answer to the question of who is at risk: people who have applied for financial aid in Florida before.¹ The Miami Herald reported that the site is the state’s main portal for college scholarships and grants, including the Bright Futures program, and that the portal still appeared to be down on Oct. 29.³

Investigation and required notices

The department says it is working with the Florida Digital Service and the Florida Department of Law Enforcement, and that it has given the Office of the Attorney General the notice that Section 501.171 of the Florida Statutes requires.¹ That law, which covers government agencies for its notice rules, calls for notice to the state’s Department of Legal Affairs within 30 days when 500 or more Floridians are affected. It also calls for notice to each affected person, by mail or email, generally within 30 days. Substitute notice, through a website posting and print and broadcast media, is allowed when direct notice is not feasible because more than 500,000 people are affected, when direct notice would cost more than $250,000, or when addresses are missing.⁴ The department’s notice does not say which method it is using.¹

A department spokesperson told FOX 13 that it “acted swiftly to stop unauthorized access, contain the breach and secure its systems.”⁵ CBS12 reported that the department had not said how the intrusion happened.⁶

The department says current financial aid is not at risk, that disbursements and tuition payments will not be delayed, and that eligibility for scholarships, grants and student loans is unchanged. It warns that some department websites and services may be disrupted while systems are restored.¹

What the department suggests

The notice encourages people to monitor credit reports and financial accounts and to consider a fraud alert or security freeze. It lists AnnualCreditReport.com and 1-877-322-8228 for free credit reports, phone numbers for Equifax, Experian and TransUnion, and the Federal Trade Commission’s identitytheft.gov/databreach. Questions go to databreach@fldoe.org.¹

The Department of Highway Safety and Motor Vehicles disclosed a separate breach Oct. 16. SignalData reported on that notice.

What the records do not show

• The notice does not say how the access happened, how long it lasted, who was responsible, or how many people’s records were actually viewed or copied.
• It gives no years or date range for the records involved.
• It does not say whether individual letters or emails will go out, or whether monitoring will be offered later.
• SignalData did not find a breach filing for this incident on another state’s attorney general portal, and the Florida attorney general’s copy of the notice is not public.
• SignalData found no federal lawsuit over the breach in court records searched Oct. 31; state court dockets were not searched.