Hackers hit Florida's student aid site, exposing up to 4.9 million Social Security numbers

The Florida Department of Education says intruders got into the state's student financial aid website, potentially exposing data on about 4.9 million people, including Social Security numbers. Staff learned of the "unauthorized criminal access" on 19 October. The department disclosed it on 29 October and names the site affected as FloridaStudentFinancialAidSG.org.

What the department has confirmed

The department's FAQ says the compromised information was "Personal Identifiable Information including Social Security number". It does not list other fields, such as names, dates of birth or bank details, and it does not say how the attackers got in or whether anyone has claimed the attack. The 4.9 million figure is hedged: the department says the breach "may have impacted approximately" that many people and that, for now, it believes the incident was limited to the financial aid site.

The department says it stopped the activity, contained the incident and secured its systems. It has notified the Florida Attorney General's office and is working with the Florida Digital Service and the Florida Department of Law Enforcement. The case is an ongoing criminal investigation. Some department websites and online services may be temporarily disrupted during the response.

According to the FAQ, current financial aid is not at risk. Payments and tuition disbursements will not be delayed, and eligibility for scholarships, grants or student loans is unchanged.

Letters are due within 30 days

Florida's data breach law, section 501.171, also applies to government bodies. It requires notice to each affected resident no later than 30 days after an organization determines a breach occurred, unless law enforcement asks for a delay. Counting from 19 October, that points to mid-November. Because more than 1,000 people are affected, the department must also notify the national credit reporting agencies.

So far the department has not announced free credit monitoring, which companies often offer after leaks of Social Security numbers. Its FAQ instead points people to free credit reports and the phone numbers of the three credit bureaus.

What to do if you used the site

Anyone who applied for Florida state student aid, or whose child did, should assume their Social Security number may be in the stolen data until notified otherwise. These steps follow the department's advice and guidance from the US Federal Trade Commission:

• Freeze your credit with Equifax, Experian and TransUnion. A freeze is free and stops identity thieves from opening new accounts in your name. Parents can also freeze a child's credit.
• Pull your free credit reports at AnnualCreditReport.com and look for accounts you did not open.
• Check bank and card statements and turn on transaction alerts.
• Treat emails, texts and calls about the breach with suspicion. Scammers often pose as the breached organization. The department's only listed contact is [email protected], and updates go on fldoe.org/databreach.
• If you spot fraud, report it at IdentityTheft.gov, the FTC's recovery site.

A Social Security number cannot be changed like a password, so a freeze is the main protection. It stays in place until you lift it, which you can do temporarily when you need to apply for a loan or a new account.