The Florida Department of Education (FLDOE) said Oct. 29 that an unauthorized party gained criminal access to its student financial aid website. About 4.9 million people may have been affected, and the information potentially exposed includes Social Security numbers.

Anyone who has previously applied for financial aid in Florida may have been affected, including St. Johns County families, the department said.

FLDOE staff discovered the breach Oct. 19, according to the department's data breach notice. The agency described it as "unauthorized criminal access" to the financial aid site and said it activated cybersecurity response protocols to stop the intrusion and secure its systems.

The department said it believes the incident was limited to the financial aid website.

What data is at risk

Information potentially exposed includes Social Security numbers, first and last names, dates of birth, home addresses, phone numbers, email addresses and gender identification codes, according to the FLDOE notice. The department said not all individuals were necessarily affected and that the specific information involved may vary by person.

The investigation is ongoing. The FLDOE has not explained how the hacker gained access to the website.

Financial aid is not affected

The department said current financial aid is not at risk. Disbursements and tuition payments will not be delayed, and eligibility for scholarships, grants or student loans will not change, according to the notice.

In a statement provided to FOX 13, a department spokesperson said the agency "acted swiftly to stop unauthorized access, contain the breach and secure its systems."

The FLDOE notified the Office of Attorney General James Uthmeier about the breach and is partnering with the Florida Digital Service and the Florida Department of Law Enforcement, according to CBS News Miami. Law enforcement is treating it as an ongoing criminal investigation.

What families should do

The FLDOE recommends these steps:

  • Monitor financial and online accounts for suspicious activity.
  • Review account statements and credit reports regularly.
  • Consider placing a fraud alert or credit freeze with a major credit bureau: Equifax (1-800-525-6285), Experian (1-888-397-3742) or TransUnion (1-800-680-7289).
  • Use the Federal Trade Commission's identity theft resources for guidance on next steps.
  • Request free credit reports by calling 1-877-322-8228.

Anyone who has previously applied for financial aid in Florida may be affected, the department said. The FLDOE's data breach page includes a full list of resources, credit bureau contacts and the FTC link.

Families with questions can reach the department at its dedicated breach email address. The FLDOE said it will post updates on its data breach page as verified details become available.