The Florida Department of Education says its staff became aware on Oct. 19 of unauthorized criminal access to the Florida Student Financial Aid website, and the department disclosed it on Oct. 29, according to The Record. The department says the incident "may have impacted approximately 4.9 million individuals" and that Social Security numbers may have been exposed.
What Florida has confirmed
The department believes the incident was limited to the Florida Student Financial Aid website.
The information that may have been exposed includes Social Security numbers, names, dates of birth, home addresses, phone numbers (mobile included), email addresses and a gender code (M or F). The department says not everyone was necessarily affected and the details vary by person.
The department says that if you have previously applied for financial aid in Florida, your information may have been affected.
It says current financial aid is not at risk, and that disbursements, tuition payments and eligibility for scholarships, grants and student loans are not affected.
It has notified the Florida Attorney General's office, as state law requires, and is working with the Florida Digital Service and the Florida Department of Law Enforcement. It calls this an ongoing criminal investigation.
What it has not said
How the intruder got in, or who they are. The department declined to describe the attackers to The Record.
Whether any of the data has been misused.
How far back the affected records go. The notice says "previously applied," with no dates.
Whether it will offer credit monitoring. Its notice does not mention one.
What you can do this week
If you have applied for financial aid in Florida, read the department's notice at fldoe.org/databreach. Questions go to [email protected].
Freeze your credit. The department suggests a fraud alert or freeze, and the FTC says a freeze is free to place and lift and does not affect your credit score. Friday's issue walked through it bureau by bureau.
Look over your credit reports and bank statements. The department points people to the free reports at annualcreditreport.com and to the FTC's identitytheft.gov/databreach page.
Up next · Wednesday
Have I Been Pwned: how to check whether your email address turned up in a known breach, and what to do if it did.