Hack of Florida's financial aid site may expose up to 4.9 million

Someone broke into Florida's student financial aid website, and as many as 4.9 million people may have lost control of their personal data, including Social Security numbers. The state Department of Education confirmed it on Thursday in an official notice, describing "unauthorized criminal access" to the Florida Student Financial Aid site.

Staff spotted the intrusion Oct. 19, ten days before the announcement. The figure is a ceiling, the agency stresses: not everyone counted was necessarily affected, and the exposed data differs from person to person.

Officials say they have contained the activity, secured their systems and notified the state Attorney General's Office. They are working with the Florida Digital Service and the Florida Department of Law Enforcement, which has opened a criminal investigation. How the attackers got in, and who they are, has not been explained. The department says more details will come once they are verified.

Aid already in motion is not at risk, the department says. Disbursements and tuition payments will not be delayed, and eligibility for scholarships, grants and loans is unchanged. Some of its online services could be briefly interrupted.

For anyone who applied for state financial aid, the department suggests watching accounts, regularly reviewing bank statements and credit reports, and considering a fraud alert or a credit freeze with the credit bureaus. It points to AnnualCreditReport.com for free reports and to IdentityTheft.gov, run by the Federal Trade Commission, for reporting and recovering from identity theft.

The risk does not end this week. A Social Security number cannot be changed like a password, and whoever holds one can use it to open credit in someone else's name months or years from now. That includes people who no longer live in Florida, and foreign students who once did. Readers in Mexico are affected if they or relatives applied for aid in that state.

Questions go to [email protected], and the department says it will post updates on the same page as the investigation moves forward.