SockAnalystFlorida Dept. of Education: ~4.9M exposed in student financial aid site breach
SockAnalyst · Security+ certified analyst.
What happened
The Florida Department of Education says hackers breached its student financial aid website (FloridaStudentFinancialAidSG.org), the hub for the state's scholarship and grant programs. It found the intrusion on October 19 and says it's contained. The department hasn't said how attackers got in, and no group has publicly claimed it. The Florida Digital Service and the Florida Department of Law Enforcement are helping with the response.
Update (2026-11-02): FLDOE says current aid, disbursements, tuition payments and scholarship/grant/loan eligibility aren't affected. It still hasn't said how attackers got in, and no group has claimed the attack (SecurityWeek).
Who's affected
About 4.9 million people, potentially anyone who has applied for Florida state financial aid in the past. Data that may have been accessed includes names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses and gender codes. Not everyone's data was necessarily affected.
✅ Fix / patch
- If you or your kids ever applied for Florida state aid, freeze your credit at Equifax, Experian and TransUnion. It's free and stops new accounts being opened in your name.
- Watch for the department's notice, and treat any calls, texts or emails about the breach or 'scholarship refunds' as suspect until you confirm them on the official site.
- Check your credit reports at annualcreditreport.com and set up an IRS Identity Protection PIN, since exposed SSNs are often used for tax refund fraud.
- Questions go to [email protected].
🔎 Quick hunt check
For schools and colleges that handle Florida aid: watch for phishing emails and help desk calls that quote student SSNs or dates of birth to sound legitimate, and flag password resets or direct-deposit changes requested by callers who 'verify' with that data.
MITRE ATT&CK: T1190, T1530, T1566, T1656
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
index=email sourcetype IN (ms:o365:reporting:messagetrace, o365:messageTrace, cisco:esa*)
(subject="*financial aid*" OR subject="*Bright Futures*" OR subject="*scholarship*" OR subject="*FLDOE*" OR subject="*data breach*")
NOT (src_user="*@fldoe.org" OR SenderAddress="*@fldoe.org")
| stats count values(subject) as subjects by src_user, recipientEmailEvents
| where Subject has_any ("financial aid","Bright Futures","scholarship","FLDOE","data breach")
| where SenderFromDomain !endswith "fldoe.org"
| summarize Count=count(), Subjects=make_set(Subject,10) by SenderFromAddress, SenderFromDomain, DeliveryAction⏱ CISA deadline
Not in CISA KEV as of Nov 14, 2026.
Sources
Related playbooks
- MUJI app breach: up to 27.26M customer records · Breach · 2026-10-30
- DreamHost File Manager breach: FTP/SFTP passwords and some webmail sessions stolen · Breach · 2026-11-06
- ARARA Message breach: 81 million email addresses taken from Japanese email-delivery service · Breach · 2026-11-07
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free