Florida student financial aid data breach: what to do now

If you or your child ever applied for state financial aid in Florida, including Bright Futures, your Social Security number may be in the Florida student financial aid data breach. The Florida Department of Education (FLDOE) says an unauthorized party reached the Florida Student Financial Aid website and that about 4.9 million people’s names, Social Security numbers and dates of birth may be exposed. The most useful step right now is a free credit freeze at all three credit bureaus, for every affected family member, including minors.

Below: what FLDOE has confirmed, what is still unknown, and the order to do things in. We checked the facts against FLDOE’s data breach page (updated November 2, 2026) and reporting from The Record and the Miami Herald, on November 3, 2026.

What happened in the Florida student aid breach

FLDOE says its staff became aware of the incident on October 19, 2026. The department describes it as limited to the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org), the portal high school and college students use to apply for state scholarships and grants such as Bright Futures. News of the breach broke on October 29, and the state took the site offline, according to The Record and the Miami Herald.

FLDOE has notified the Florida Attorney General, as state law requires, and is working with the Florida Digital Service and the Florida Department of Law Enforcement. It says the incident is contained. No group has publicly claimed the attack, and the department hasn’t said how the attacker got in.

Question	Status (Nov 3, 2026)
How many people?	About 4.9 million, per FLDOE. Not every person in the system is necessarily affected.
What data?	Names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses and gender codes
Bank or card numbers?	Not listed by FLDOE
Which years of records?	Not stated
Notification letters?	Not announced
Free credit monitoring?	Not announced
Aid payments affected?	No. FLDOE says eligibility and disbursements are not delayed.

Am I affected?

FLDOE has not published a lookup tool, and it hasn’t said whether it will mail letters. Treat yourself as affected if you, or a child you claim, created an account on the Florida Student Financial Aid site to apply for Bright Futures or another state scholarship or grant. Parents should pay particular attention: many applicants were high school students under 18, and a child’s Social Security number can be misused for years before anyone checks the child’s credit.

Be wary of anyone offering to “check if you’re affected.” Large breaches draw lookalike emails and texts within days, and FLDOE’s only listed contact is the databreach@fldoe.org address on its official page.

What to do now, in order

1. Freeze your credit at all three bureaus

A freeze stops lenders from opening new credit in your name. It doesn’t affect your existing cards or your credit score, and you can lift it temporarily when you apply for a loan. You must place it separately at each bureau:

• Equifax (1-800-525-6285, the number FLDOE lists)
• Experian (1-888-397-3742)
• TransUnion (1-800-680-7289)

Each bureau gives you a PIN or account login to unfreeze later. Save those in a password manager.

2. Freeze your child’s credit too

Federal law lets parents freeze credit for children under 16 at no cost. The bureaus usually handle these by mail or through an online upload, and ask for the child’s birth certificate and Social Security card plus proof of your own identity. Applicants who are 16 or older can place their own freeze online. If your child is now in college, ask them to do it today.

3. Or place a fraud alert if you can’t freeze yet

A fraud alert is weaker than a freeze, but it takes two minutes: you contact one bureau and it notifies the other two. Lenders are then asked to verify your identity before opening credit. An initial alert lasts one year.

4. Get an IRS Identity Protection PIN

With a name, Social Security number and date of birth, a criminal can file a fake tax return and claim your refund. An IRS Identity Protection PIN is a six-digit number that must be on any return filed with your SSN. You can request one at IRS.gov after verifying your identity, and you get a new one each year. Dependents can have one too.

5. Check your credit reports

Pull your free reports at AnnualCreditReport.com (1-877-322-8228) and look for accounts, addresses or hard inquiries you don’t recognize. For a child, a report that exists at all is a warning sign, because most minors have no credit file.

6. Lock down the email address that was exposed

The breach included email addresses and phone numbers, so expect targeted phishing that mentions Bright Futures, scholarships or “your FLDOE account.” Turn on two-step verification for that email account (our two-step verification guide covers Gmail and Outlook) and check whether the address appears in other leaks with our data breach email check.

Scams to expect after this breach

• Fake refund or “aid hold” messages asking you to confirm your SSN or bank details to release a scholarship payment. FLDOE says disbursements are not affected.
• Paid “breach protection” offers that claim to be from the state. FLDOE has not announced any monitoring partner.
• Texts with short links about your application status. The pattern matches the fake delivery texts we’ve covered: don’t tap the link, go to the official site yourself.
• Calls claiming to be from the IRS or a bank that already know your birth date and address. Knowing those details proves nothing now.

If someone already used your information

Report it at IdentityTheft.gov, the FTC’s site, which builds a recovery plan and pre-filled letters for creditors. Then call the fraud department of any company where an account was opened, and file a police report if a creditor asks for one. If a fake tax return was filed, the IRS asks you to submit Form 14039, Identity Theft Affidavit.

What we don’t know yet

As of November 3, 2026, FLDOE hasn’t said how the attacker got in, how many years of applications were stored, whether parents’ details were included, or whether it will offer credit monitoring or send letters. We’ll update this article when the department publishes more. If you are a patient or customer caught in another recent breach, our Quest Diagnostics breach guide follows the same steps.

FAQ

Will FLDOE pay for credit monitoring?

It hasn’t said. A credit freeze gives stronger protection than monitoring and costs nothing, so there’s no reason to wait for an offer.

Does a credit freeze hurt my credit score?

No. A freeze only blocks new lenders from reading your report. Your score and existing accounts are unaffected.

Is my Bright Futures award at risk?

FLDOE says current eligibility and payments are not affected by the incident.

Who do I contact with questions?

FLDOE lists the email address databreach@fldoe.org. It has not published a phone hotline.

Next step

Place the three freezes now, starting with your own, then your child’s. It takes about 15 minutes online and closes the main door this breach opened.

Sources

• Florida Department of Education: Data breach information and FAQ (updated Nov 2, 2026)
• The Record: Florida warns 5 million affected by financial aid site breach (Oct 30, 2026)
• GovTech / Miami Herald: 4.9M students potentially affected (Oct 29, 2026)
• FTC: IdentityTheft.gov data breach guidance
• IRS: Get an Identity Protection PIN