A data breach at the Florida Department of Education may have exposed the personal information of 4.9 million people.
The October 19, 2026, breach affected the Florida Financial Aid website that administers scholarships, grants, and other state-managed financial assistance programs for college students.
Florida Department of Education data breach
Upon learning of the incident, the Department activated its cyber incident response protocols and took immediate steps to contain the threat actor’s activity.
The Department also partnered with the Florida Digital Service and the Florida Department of Law Enforcement to respond to the incident. It also notified relevant authorities, including the Florida Attorney General’s Office. A criminal investigation has also been initiated. The Department has also created a dedicated support team that can be reached through databreach@fldoe.org to assist victims.
Meanwhile, FLDOE says the data breach did not affect the disbursement of students’ financial aid or tuition payments or impact the eligibility for student loans, scholarships, or grants.
However, it exposed the victims’ Social Security Numbers, first and last names, dates of birth, home addresses, phone numbers, email addresses, and gender identification codes (M or F).
Nevertheless, the leaked data varied by individual, and not everyone whose information was stored on FLDOE servers was affected. According to the Department, the data breach affected 4.9 million people who applied for the state’s financial aid.
The incident also temporarily disrupted FLDOE websites and online systems. However, the Department said it is working to restore the impacted services safely to protect personal information.
Nevertheless, it advised victims to monitor their online accounts, financial statements, and credit reports for suspicious activity and consider placing fraud alerts or credit freezes to protect themselves from fraud.
According to John Strand, owner of Black Hills Information Security, the financial impact of such data breaches may take time to manifest: “For some victims, the identity theft and financial damage could surface years down the line.”
So far, the Department has not disclosed the threat actor’s identity, and no cybercrime gang has claimed responsibility. It also remains unclear whether the attackers demanded a ransom, and the attack vector remains unknown.
“The Florida Department of Education hasn’t shared any details about how this breach happened or who hacked it,” said Paul Bischoff, Consumer Privacy Advocate at Comparitech. “This is normal because hacked organizations don’t want to attract more attacks, as frustrating as it might be for victims.”
Cyber attacks continue to target education systems
Government-run education systems have experienced a string of cyber attacks, exposing personally identifiable information of students and faculty members.
“I never get used to hearing about incidents like this. It seems we barely finish discussing one breach before another reminds us how much sensitive information people are required to entrust to the systems they depend on,” said Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security.
Between September and May 2026, a cyber attack targeted the California Department of Education-managed Educational Testing Service (ETS), exposing student data, including disability information.
In 2024, a data breach stemming from a PowerSchool hack hit the South Carolina Department of Education and the Alabama Department of Education. In the same year, the New York State Education Department (NYSED) was compromised via an Instream file scanning service, affecting 25 education agencies and resulting in a $125,000 fine.
In 2023, the Minnesota Department of Education and the New York City Department of Education were among hundreds of organizations compromised by the MOVEit data breach.
Hackers have also targeted third-party education platforms to target learning institutions. Third-party systems affected by data breaches include Illuminate Education, PowerSchool, and Instructure’s Canvas learning management systems (LMS).
