The Florida Department of Education (FLDOE) says hackers breached its student financial aid website, potentially exposing the personal information of roughly 4.9 million people.
The department discovered the intrusion on October 19. It says it launched its incident response procedures after detecting the threat and has since contained the breach.
“At this time, we believe the incident was limited to the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org) and may have impacted approximately 4.9 million individuals,” the department said.
The website is the online hub for Florida’s state-funded scholarship and grant programs. FLDOE warns that anyone who has applied for financial aid in the state in the past could be among those affected.
Names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses, and gender codes are among the data types the attackers may have accessed.
“Not all individuals were necessarily affected, and the specific information involved may vary by person,” FLDOE noted.
The department has not disclosed how the attackers got in or who is responsible, and no threat group appears to have publicly claimed the attack. The Florida Digital Service and the Florida Department of Law Enforcement are assisting with the response.
The department has cautioned that some of its websites and online services may be disrupted for a time as remediation continues.
According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.
The breach follows a September incident at the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after the ShinyHunters extortion group claimed to have stolen more than 200,000 driver records.
FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.
Related: Revolve Data Breach Impacts at Least 180,000 People
Related: Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
Related: Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
