4.9 Million Social Security Numbers Were Sitting Behind a Student Aid Website

On October 29, the Florida Department of Education disclosed that hackers had breached the state's student financial aid website, FloridaStudentFinancialAidSG.org. The department estimates that approximately 4.9 million people may be affected. The compromised data includes Social Security numbers, dates of birth, home addresses, and other personal information. Staff discovered the unauthorized access ten days earlier, on October 19, and the Florida Department of Law Enforcement opened a criminal investigation.

No attacker group has claimed responsibility. The department says current financial aid disbursements, tuition payments, and scholarship eligibility are not affected. But for the millions of Floridians whose Social Security numbers may now be in criminal hands, that assurance misses the point entirely.

The Data Nobody Thought About

Here is the detail that should make every executive sit up: anyone who has ever applied for Florida state financial aid may be affected. The department has not said how far back its records go. That means a college student who filled out an application a decade ago, long before the current security team was hired, could be one of the 4.9 million.

This is what I call the "data you forgot you had" problem. In Cyber Risk Is Business Risk, I describe how organizations accumulate sensitive information over years and then lose track of what they are protecting and why. A financial aid application asks for Social Security numbers because it has to. But once the aid is disbursed, why does the SSN remain in a web-accessible database? Who decided on the retention period? Who reviewed it?

Most organizations cannot answer those questions. That silence is the real vulnerability.

Two Florida Breaches in Two Months

This is the second major data breach to hit a Florida state agency in 2026. In September, hackers breached the Florida Department of Highway Safety and Motor Vehicles through compromised credentials, gaining access to driver records. Now the education department. Two different agencies, two different systems, and the same fundamental problem: sensitive personal data stored in internet-facing systems without adequate protection.

The pattern is not unique to Florida. State and local government agencies everywhere face the same pressures: tight budgets, aging systems, and mandates to collect and retain enormous volumes of personal data. But the pattern should alarm any executive whose organization shares data with government systems or operates under similar constraints.

The Three Questions This Breach Forces You to Ask

In my book, I describe the Three Questions framework for boards and executives who want to cut through cybersecurity complexity. This breach makes each one concrete.

Question One: What do we actually have? The Florida Department of Education held 4.9 million Social Security numbers in a single web application. Did anyone in leadership know the number was that large? Did they know the data included people who applied years ago? Every organization has databases that grew quietly over time, accumulating sensitive records that nobody inventories. If your CISO cannot tell you, within 48 hours, exactly how many Social Security numbers your organization holds and where they are stored, you have a problem that no firewall can fix.

Question Two: Who can reach it? The breached system was a public-facing website. The department has not disclosed how the attackers gained access. But the question for your organization is simpler: which of your web-facing applications connect directly to databases holding personally identifiable information? Is there a web application firewall in front of them? Is the database segmented from the rest of the network? Is access logged and monitored in real time? If you have a customer portal, a benefits enrollment system, or a vendor registration form, the architecture may look more like FloridaStudentFinancialAidSG.org than you think.

Question Three: What happens when it fails? Florida law requires individual notification within 30 days of determining a breach has occurred, and the department met that deadline. It also requires notifying the state Attorney General when 500 or more residents are affected. But notification is not the same as readiness. Does your organization have a tested incident response plan that can handle notifying nearly five million people? Can your call center absorb that volume? Has the board reviewed the plan in the past year?

What to Ask Your CISO This Week

If this story prompts one conversation in your next leadership meeting, make it about data retention. Here are the questions worth asking:

How long do we keep Social Security numbers, and is there a business or legal reason for the retention period? Many organizations keep data because nobody has decided to delete it. That is not a policy; it is an accident waiting to be discovered.

Which of our web-facing applications have a direct path to databases holding PII? The answer should come with an architecture diagram, not a shrug.

When was our last data inventory, and did it include legacy systems and archived databases? If the answer is "we haven't done one" or "it didn't cover legacy systems," you know where to start.

Have we tested our breach notification process at scale? A tabletop exercise that assumes 500 affected customers is not the same as a plan for 4.9 million.

The Uncomfortable Truth

This breach is not a story about one state's IT department. It is a story about what happens when organizations collect sensitive data because they must, store it because nobody told them to stop, and protect it with the same resources they had a decade ago.

Every business, every hospital system, every university, and every government agency that asks for a Social Security number inherits a duty of care that outlasts the transaction. The question is not whether you collect sensitive data. It is whether you know how much you have, where it lives, and what happens when someone gets to it.

For 4.9 million Floridians, that question was answered for them.