Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk

Hi, what are you looking for?

The Florida Department of Education says SSNs and other personal data may have been exposed in a breach of its financial aid website.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

The Florida Department of Education (FLDOE) says hackers breached its student financial aid website, potentially exposing the personal information of roughly 4.9 million people.The departmentdiscovered the intrusionon October 19. It says it launched its incident response procedures after detecting the threat and has since contained the breach.“At this time, we believe the incident was limited to the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org) and may have impacted approximately 4.9 million individuals,” the department said.The website is the online hub for Florida’s state-funded scholarship and grant programs. FLDOE warns that anyone who has applied for financial aid in the state in the past could be among those affected.Names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses, and gender codes are among the data types the attackers may have accessed.“Not all individuals were necessarily affected, and the specific information involved may vary by person,” FLDOE noted.Advertisement. Scroll to continue reading.The department has not disclosed how the attackers got in or who is responsible, and no threat group appears to have publicly claimed the attack. The Florida Digital Service and the Florida Department of Law Enforcement are assisting with the response.The department has cautioned that some of its websites and online services may be disrupted for a time as remediation continues.According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.The breach follows a Septemberincidentat the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after theShinyHuntersextortion group claimed to have stolen more than 200,000 driver records.FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The departmentdiscovered the intrusionon October 19. It says it launched its incident response procedures after detecting the threat and has since contained the breach.“At this time, we believe the incident was limited to the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org) and may have impacted approximately 4.9 million individuals,” the department said.The website is the online hub for Florida’s state-funded scholarship and grant programs. FLDOE warns that anyone who has applied for financial aid in the state in the past could be among those affected.Names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses, and gender codes are among the data types the attackers may have accessed.“Not all individuals were necessarily affected, and the specific information involved may vary by person,” FLDOE noted.Advertisement. Scroll to continue reading.The department has not disclosed how the attackers got in or who is responsible, and no threat group appears to have publicly claimed the attack. The Florida Digital Service and the Florida Department of Law Enforcement are assisting with the response.The department has cautioned that some of its websites and online services may be disrupted for a time as remediation continues.According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.The breach follows a Septemberincidentat the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after theShinyHuntersextortion group claimed to have stolen more than 200,000 driver records.FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

“At this time, we believe the incident was limited to the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org) and may have impacted approximately 4.9 million individuals,” the department said.The website is the online hub for Florida’s state-funded scholarship and grant programs. FLDOE warns that anyone who has applied for financial aid in the state in the past could be among those affected.Names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses, and gender codes are among the data types the attackers may have accessed.“Not all individuals were necessarily affected, and the specific information involved may vary by person,” FLDOE noted.Advertisement. Scroll to continue reading.The department has not disclosed how the attackers got in or who is responsible, and no threat group appears to have publicly claimed the attack. The Florida Digital Service and the Florida Department of Law Enforcement are assisting with the response.The department has cautioned that some of its websites and online services may be disrupted for a time as remediation continues.According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.The breach follows a Septemberincidentat the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after theShinyHuntersextortion group claimed to have stolen more than 200,000 driver records.FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The website is the online hub for Florida’s state-funded scholarship and grant programs. FLDOE warns that anyone who has applied for financial aid in the state in the past could be among those affected.Names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses, and gender codes are among the data types the attackers may have accessed.“Not all individuals were necessarily affected, and the specific information involved may vary by person,” FLDOE noted.Advertisement. Scroll to continue reading.The department has not disclosed how the attackers got in or who is responsible, and no threat group appears to have publicly claimed the attack. The Florida Digital Service and the Florida Department of Law Enforcement are assisting with the response.The department has cautioned that some of its websites and online services may be disrupted for a time as remediation continues.According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.The breach follows a Septemberincidentat the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after theShinyHuntersextortion group claimed to have stolen more than 200,000 driver records.FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses, and gender codes are among the data types the attackers may have accessed.“Not all individuals were necessarily affected, and the specific information involved may vary by person,” FLDOE noted.Advertisement. Scroll to continue reading.The department has not disclosed how the attackers got in or who is responsible, and no threat group appears to have publicly claimed the attack. The Florida Digital Service and the Florida Department of Law Enforcement are assisting with the response.The department has cautioned that some of its websites and online services may be disrupted for a time as remediation continues.According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.The breach follows a Septemberincidentat the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after theShinyHuntersextortion group claimed to have stolen more than 200,000 driver records.FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

“Not all individuals were necessarily affected, and the specific information involved may vary by person,” FLDOE noted.Advertisement. Scroll to continue reading.The department has not disclosed how the attackers got in or who is responsible, and no threat group appears to have publicly claimed the attack. The Florida Digital Service and the Florida Department of Law Enforcement are assisting with the response.The department has cautioned that some of its websites and online services may be disrupted for a time as remediation continues.According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.The breach follows a Septemberincidentat the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after theShinyHuntersextortion group claimed to have stolen more than 200,000 driver records.FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The department has not disclosed how the attackers got in or who is responsible, and no threat group appears to have publicly claimed the attack. The Florida Digital Service and the Florida Department of Law Enforcement are assisting with the response.The department has cautioned that some of its websites and online services may be disrupted for a time as remediation continues.According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.The breach follows a Septemberincidentat the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after theShinyHuntersextortion group claimed to have stolen more than 200,000 driver records.FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The department has cautioned that some of its websites and online services may be disrupted for a time as remediation continues.According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.The breach follows a Septemberincidentat the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after theShinyHuntersextortion group claimed to have stolen more than 200,000 driver records.FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.The breach follows a Septemberincidentat the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after theShinyHuntersextortion group claimed to have stolen more than 200,000 driver records.FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

The breach follows a Septemberincidentat the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after theShinyHuntersextortion group claimed to have stolen more than 200,000 driver records.FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Related:Revolve Data Breach Impacts at Least 180,000 PeopleRelated:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Related:Chainalysis Discloses Data Breach Following AI-Driven CyberattackRelated:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Related:Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.