Florida student aid website hack may have exposed 4.9 million people

SecurityWeek reported that an unauthorized party entered Florida's student financial aid portal, FloridaStudentFinancialAidSG.org, and that records on about 4.9 million people may have been exposed. The Florida Department of Education said it discovered the intrusion on October 19 and contained it. Tech Insider reported that the public announcement came on October 29.

The website handles applications for state-funded scholarships and grants. Department officials warned that anyone who has ever applied for Florida financial aid could be affected. Information that may have been exposed includes full names, Social Security numbers, dates of birth, home and email addresses, phone numbers and gender codes. The department said not everyone was necessarily affected and the exact data involved can differ from person to person. Tech Insider noted that a name, date of birth and Social Security number together form a standard identity-fraud profile.

The department did not say how the intruder entered or name any suspect, and no group has claimed responsibility. Florida has assigned its Digital Service and Department of Law Enforcement to support the response. Other department websites and online services may face temporary interruptions during the investigation.

The department said existing financial aid is safe. There will be no delay to disbursements or tuition payments the department handles, and no change to eligibility for scholarships, grants or student loans. The department stated: "At this time, we believe the incident was limited to the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org)".

Tech Insider noted that The Record and the Florida Phoenix reported the potential count at as many as 4.9 million people, while some local reports put it near 5 million. As of October 31, the attacker, entry method and final count were still unconfirmed.

For admin teams, Tech Insider advised reducing data collection, isolating applicant portals, encrypting sensitive fields at rest and logging bulk export queries. Any query that pulls millions of records should alert an on-call engineer, and teams should practice their notice procedures before an incident forces them to use them. For affected people, the department recommended monitoring accounts, reviewing credit reports, and considering a fraud alert or credit freeze through Equifax, Experian and TransUnion.