Hackers Breach Florida Student Financial Aid Website, Exposing Social Security Numbers of Up to 4.9 Million People

Hackers broke into the Florida Department of Education's student financial aid website and compromised personal information, including Social Security numbers, that may belong to as many as 4.9 million people, the department said Thursday. Department staff learned of the intrusion on Oct. 19, but the agency did not make it public until Oct. 29, 10 days later.

The breach centers on FloridaStudentFinancialAidSG.org, the state's main portal for college scholarships and grants, including the lottery-funded Bright Futures program. In a statement, the department described "unauthorized criminal access" to the site and said, "At this time, we believe the incident was limited to the Florida Student Financial Aid website." The department said the hack "may have impacted approximately 4.9 million individuals."

It is the second major breach of a Florida state agency's records this fall, following the September intrusion at the Department of Highway Safety and Motor Vehicles that exposed driver records.

What the department has disclosed

The department said it "immediately activated its cybersecurity response protocols" once staff discovered the activity, moving to stop it, contain the incident and secure its systems. A frequently asked questions page on the incident describes the compromised information as "Personal Identifiable Information including Social Security number," according to the Miami Herald.

Several outlets reported Thursday that officials had not specified what other personal information was taken. WEAR-TV in Pensacola, citing the department's notice, reported a longer list of data that may have been exposed: first and last names, dates of birth, home addresses, phone numbers including mobile numbers, email addresses and gender codes. The department cautioned that "not all individuals were necessarily affected" and that the specific information involved may vary from person to person.

The department has not said how the attackers got in, who was behind the intrusion, how long they had access or whether any of the stolen information has been misused. It has not explained why it waited 10 days after discovering the breach to announce it. The agency said it "will provide additional information as verified details become available."

The financial aid website and portal appeared to be down on Thursday, according to the Herald and CBS News Miami. The department warned that some of its websites and online services may see temporary disruptions while full functionality is restored.

Who may be affected

The 4.9 million figure reflects how many people have passed through the state's student aid system. The portal is where high school seniors apply for state scholarships and grants and where current college students manage their awards, so the people potentially affected include current students as well as many who applied years ago and have long since graduated.

The department encouraged anyone who has previously applied for Florida financial aid to monitor their credit reports and financial accounts "out of an abundance of caution," according to WEAR-TV.

Because the site handles applications from high school students, some of the people whose information may have been exposed were likely minors when they applied. A Social Security number tied to a name and birth date can be used to open new credit in that person's name, and young adults who rarely check their credit may not notice fraud for months or years.

Scholarships and aid are not affected

Department officials sought to reassure students and families that money is still flowing. "Current financial aid is not at risk," the department said, according to WPTV. Officials said the breach will not delay financial aid disbursements or tuition payments from the department, and it will not affect eligibility for department scholarships, grants or student loans.

That assurance matters for Florida college students whose tuition is covered in whole or in part by Bright Futures and the other state awards administered through the portal.

No credit monitoring offer so far

As of Thursday, the department had not announced free credit monitoring or identity protection services for people whose information may have been exposed. None of the department statements reported by CBS News Miami, WKMG, WPTV, WEAR-TV or the Miami Herald mentioned such an offer. Instead, the department pointed people to free tools they can use on their own.

That differs from the response to the state's other recent breach. After the Department of Highway Safety and Motor Vehicles said it learned on Sept. 4 that an intruder had reached Florida driver records, that agency said drivers whose information was potentially affected and who have a valid mailing address would receive a letter offering one year of free credit monitoring through Sontiq, a TransUnion company. That breach was traced to a Plant City police login used on a personal device, according to the state's account.

The department's guidance for anyone who has applied for state financial aid includes the following steps:

• Monitor financial and online accounts for suspicious activity.
• Review account statements and credit reports regularly. Free credit reports are available at AnnualCreditReport.com or by calling 1-877-322-8228.
• Consider placing a fraud alert or a credit freeze with the three major credit bureaus: Equifax (1-800-525-6285), Experian (1-888-397-3742) and TransUnion (1-800-680-7289).
• Use the Federal Trade Commission's identity theft resources at IdentityTheft.gov.

A credit freeze blocks lenders from pulling a person's credit file, which makes it much harder for a thief to open an account with a stolen Social Security number. Freezes are free under federal law and can be lifted temporarily when a person needs to apply for a loan, an apartment or a credit card.

The investigation

The department said it notified the Office of the Attorney General, as required under section 501.171 of the Florida Statutes, the state's data breach notification law. Attorney General James Uthmeier's office received the notice, according to CBS News Miami. The department is also working with the Florida Digital Service, the state's cybersecurity office, and the Florida Department of Law Enforcement. The incident "remains under criminal investigation," the department said.

Florida's breach law requires a state agency or business to notify the attorney general when a breach affects 500 or more Floridians, and to notify affected individuals within 30 days of determining that a breach occurred, with limited room for extensions or delays requested by law enforcement. The department has not said whether or when it will send individual notices to the people whose data was involved.

Two state agencies breached in two months

The education breach comes as the state is still working through the fallout from the driver records intrusion. The highway safety department said it learned of that breach on Sept. 4 and issued a public statement on Sept. 11. It has said it has no evidence the data was misused and that the breach was quickly contained, but it has not disclosed how many drivers were affected.

The two incidents involve different agencies and different systems, and nothing released so far links them. Together, though, they mean millions of Floridians have now been told that a state system holding their personal information was accessed by criminals this fall.

What's next

The department said information may change as the investigation continues and that it is posting updates on its data breach information page at fldoe.org/databreach.stml. People with questions can email databreach@fldoe.org.

Key open questions include whether the department will mail notices to the 4.9 million people potentially affected, whether it will offer free credit monitoring as the highway safety department did, when the financial aid portal will return to full service, and what the criminal investigation by FDLE turns up about who was responsible. Anyone who has ever applied for a Florida scholarship or grant, or whose child has, should consider freezing their credit now rather than waiting for a letter.