4.9 million Social Security numbers, and 10 days of silence
The Florida Department of Education announced Thursday that criminals accessed its student financial aid website and may have exposed personal information — including Social Security numbers — for up to 4.9 million people. The department learned of the breach on October 19. The public learned of it on October 29.
- Breach of the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org): detected Oct. 19, disclosed Oct. 29. Up to ~4.9 million people potentially affected — a provisional count, still being verified. Confirmed exposed: Social Security numbers; the department hasn't specified what other personal information was taken.
- FLDOE says the breach was limited to the aid website; current financial aid, disbursements, and eligibility are not affected; some department websites and services may be temporarily disrupted during the response. The Attorney General's office was notified, FDLE and the Florida Digital Service are working it, and a criminal investigation is active.
- The disclosure came on day ten. Florida's breach law allows notice as late as 30 days after a breach is determined — the department was inside the legal window the whole time it said nothing.
- This is Florida government's third mass data failure of the fall: FLHSMV's September breach (compromised credentials; an expanded substitute notice Oct. 16 conceded the pool may be larger) and Citrus County's 1,300 employees exposed by a wrong email attachment. Three different causes — criminal intrusion, stolen credentials, human error — one common thread: the public finds out last.
- What to do if you ever applied for state aid: monitor accounts, pull free reports at AnnualCreditReport.com, consider a fraud alert or credit freeze, and FLDOE takes questions at [email protected].
The Florida Department of Education put out a news release Thursday with a number in it that should stop anyone who has ever applied for state student aid: 4.9 million. That's how many people may have had personal information — Social Security numbers confirmed among it — exposed when criminals got unauthorized access to the Florida Student Financial Aid website, the portal at FloridaStudentFinancialAidSG.org. The department says it believes the breach was limited to that site, that current financial aid is not at risk, that disbursements and eligibility won't be affected, and that some of its websites and services may hiccup while systems are restored. The 4.9 million figure is provisional; investigators are still verifying the scope. The Attorney General's office has been notified, the Florida Department of Law Enforcement and the Florida Digital Service are on it, and the incident is under criminal investigation.
Now read the department's own timeline. Its staff became aware of the breach on October 19. The news release is dated October 29. Ten days. Ten days in which whoever took the data had it, and the up to 4.9 million people it belongs to did not know. Information moves at the speed of light now — a stolen Social Security number can be sold, bundled, and used before the victim's coffee cools. What moved at the old speed was the notice. To be precise about it: the department broke no deadline. Florida law gives covered entities as long as 30 days after determining a breach to notify the people affected, and the state was inside that window every silent day. That is exactly the problem worth naming. A 30-day rule written for the age of mailed letters now governs data that criminals monetize in an afternoon — and 'we complied with the timeline' will be offered, correctly, as the defense. Legal and acceptable parted company somewhere around day two.
Nor is this an isolated embarrassment; it's the fall's pattern. In September, the Department of Highway Safety and Motor Vehicles was breached through compromised credentials tied to a Plant City police employee, and on October 16 that agency issued an expanded substitute notice conceding it may not have current addresses for everyone affected — people who no longer hold a Florida license may never get a letter at all. In Citrus County, as this page reported Monday, some 1,300 county employees and family members had their Social Security numbers mailed out as a public-records attachment that nobody adequately reviewed. Criminal intrusion, stolen credentials, and a wrong attachment: three different doors, all left open by Florida governments in a single season, and in every case the people whose numbers walked out were the last to know.
What the department is telling the possibly-affected to do is the standard kit, and it's worth doing if you or your kids ever touched Florida student aid: watch bank and credit accounts, pull your free reports at AnnualCreditReport.com, and seriously consider a fraud alert or a credit freeze with the major bureaus — a freeze is the one step that actually stops a new account from being opened in your name. IdentityTheft.gov has the federal playbook, and the department is taking questions at [email protected]. It promises more information 'as verified details become available.'
Fair enough. But verification is the state's pace, and the data is already moving at the criminals' pace. The question this disclosure raises isn't whether Florida followed its 30-day rule — it did, with 20 days to spare. It's whether a rule built for a slower world still counts as protection when the thing being protected can circle the planet before the press release clears review. Ten days says the rule, not just the website, is what got breached.