Florida's Education Department Says 4.9 Million Financial Aid Applicants May Have Had Their Social Security Numbers Taken. It Took Ten Days to Say So, and It Still Has Not Said How.
If you applied for Florida financial aid, or you are the parent of someone who did, assume your Social Security number was taken and freeze your credit with all three bureaus now. The Florida Department of Education says about 4.9 million people may be affected.
The department says it became aware on October 19 of unauthorized criminal access involving the Florida Student Financial Aid website. It disclosed the breach on Thursday, October 29, ten days later. The Record reported on October 30 that the data includes names, addresses, phone numbers, genders, email addresses, dates of birth and Social Security numbers. GovTech, syndicating the Miami Herald, reported the site involved was FloridaStudentFinancialAidSG.org and that the people affected include applicants for Bright Futures and other scholarship and grant programs, which are used by high schoolers and current college students.
What the department has said
The department became aware of the breach on October 19 and disclosed it on October 29.
The incident involves the Florida Student Financial Aid website, which GovTech names as FloridaStudentFinancialAidSG.org.
About 4.9 million individuals may be affected. The Record's body says nearly five million people who have applied for financial aid in the state.
The data includes Social Security numbers, according to both The Record and GovTech.
The department took the financial aid site down. GovTech said it still appeared to be down when it published.
The department is working with the Florida Digital Service and the Florida Department of Law Enforcement, and reported the incident to the Attorney General's office.
The department told people to monitor credit reports and financial accounts. GovTech adds that it suggested a fraud alert or credit freeze and gave [email protected] as a contact.
What it has not said
This is the list that matters, because each gap changes what a family should do.
Who did it and how. The department declined to comment on the nature of the incident or the attackers, per The Record.
Any ransom or leak-site claim. None is reported. We found no group claiming it.
Which years. Neither report says how far back the applicant records go. Anyone who has applied through that site is the safe assumption.
Credit monitoring. Neither report says the department is paying for any.
What "may" means. Both reports say 4.9 million may be affected. The department has not said how many are confirmed.
What to do
The first two items are in line with the department's advice. The rest is our recommendation.
Freeze credit at Equifax, Experian and TransUnion. A freeze is free and stops a new account from being opened with a stolen Social Security number.
Place a fraud alert if you do not want a full freeze.
Do this for each affected person, including children. Our understanding is that US law allows a parent or guardian to freeze a minor's credit file, and that matters here because many applicants were high schoolers. Check each bureau's process, since we did not verify the current steps.
Expect phishing that uses the data in the breach. Names, dates of birth and home addresses make a call or email claiming to be a school, a lender or the department more believable. Do not give your Social Security number to anyone who contacted you first.
Contact [email protected] if you have questions about whether you are included. We did not test that address.
What we hold, and what we don't
No indicators have been published, so we have nothing to add to our feed and we added nothing. We have no sighting of our own, and our edge does not see traffic to a state education site. We are citing the department's statement as reported by The Record, GovTech and the Miami Herald.
Limits
This rests on news reports of the department's statement. The department's own page, fldoe.org/databreach, and a Florida Phoenix report were blocked to our fetch, so we did not read the department's FAQ or notice directly. The date discovered, the date disclosed, the 4.9 million figure and the data types are as those reports state them. The parent-and-minor credit freeze point is our general understanding and not something the department said.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments