Florida financial aid breach exposes 4.9M Social Security numbers

Florida's Department of Education confirmed Thursday that the Florida Student Financial Aid website was breached, exposing names, addresses, phone numbers, genders, email addresses, Social Security numbers and dates of birth for roughly 4.9 million aid applicants. The state learned of the intrusion on Oct. 19, took the site down, and says the incident is now contained. It also says financial aid, scholarships, grants and loans won't be delayed.

What the department didn't say is what kind of incident this was or who was behind it. Its statement leans on breach-notice boilerplate, describing "an unauthorized party" gaining access to "company or customer information," phrasing that fits a retail vendor more than a state education agency holding the identity files of millions of students. "Contained" is doing a lot of work here. It tells the reader the intrusion is over. It doesn't tell the reader whether the data was exfiltrated, and SSNs paired with dates of birth and addresses can't be recalled once they leave.

The context makes the reassurance harder to accept. This is Florida's second major state-agency breach of the year, following the Department of Motor Vehicles incident last month, when a "prominent hacking group" claimed the theft and has kept offering the stolen data for sale through October. A week earlier, California disclosed a contractor breach touching every student enrolled in its public schools over the past three years.

For the 4.9 million people in the file, there is no operational fix in this notice. The state can keep aid flowing and still not solve the actual exposure. The useful Monday action is the boring one: freeze credit and watch for new accounts. The reassurance about aid flow doesn't address the identity-theft risk the breach actually created.