Most of the breaches we write about affect a business's customers. This one affects a business's staff. If you employ people in Florida, a good number of them, or their children, applied for state college aid at some point, and their Social Security numbers were in the system that was breached.
What happened
The department's notice is brief. "On October 19, DOE staff became aware of a data breach incident involving unauthorized criminal access to the Financial Aid Website," it says, and the department "immediately activated its cybersecurity response protocols" to stop the activity and secure its systems. It reported the breach to the Florida Attorney General's office, as state law requires, and is working with the state's digital service and law enforcement agency.
Ten days passed between discovery and the public announcement on 29 October. The department has declined to say how the attacker got in or who it was. By then the financial aid website was down, showing a notice that it was "under maintenance and will be available soon."
The department's guidance to students is reassuring on one point: current financial aid is not at risk, and the incident will not delay disbursements, tuition payments or eligibility for scholarships and grants. What it does not yet offer is the usual help for the people whose identity numbers were exposed. There is no credit monitoring offer, no phone line, and the only contact is an email address, [email protected].
This is Florida's second large government breach this year, after the state motor vehicle agency's breach the month before. There is no reported link between the two.
Why a business should care
Your employees are in this. The portal has been the route to Florida's state college aid for years, including Bright Futures. Anyone on your staff who went to college in Florida, or whose children did or are about to, may be among the 4.9 million. Many applicants apply while still in high school, so some of those affected were very likely minors when their data was collected.
Social Security numbers do not expire. A leaked password can be changed. A leaked Social Security number, combined with a name, date of birth and address, is enough to open credit in someone's name, file a fraudulent tax return or apply for benefits, and it stays useful to criminals for life. A young person whose number was exposed may not discover it is being misused until they apply for their first loan or credit card years from now.
Phishing follows breaches. Lists like this one are used to make scam messages convincing. Expect emails and text messages to your staff that mention financial aid, Bright Futures, refunds or "verifying your identity" after the breach. A message that already knows someone's name, address and date of birth is far more persuasive than one that does not.
The same exposure exists in your own records. Most businesses hold Social Security numbers for every employee they have ever had, in payroll, HR systems, tax forms and old spreadsheets. The questions this breach raises for a state agency apply to you at a smaller scale: how far back do you keep them, who can reach them, and how would you tell people if they leaked.
What to actually do
Tell your staff. A short note saying what happened and what to do is a kindness and costs nothing. Many people will not see the department's announcement.
Recommend a credit freeze. Freezing credit at all three bureaus (Equifax, Experian and TransUnion) is free and is the most effective protection against someone opening new credit in a person's name. Parents can also freeze credit for children under 16. The FTC's IdentityTheft.gov has instructions for both, and free credit reports are available at AnnualCreditReport.com.
Suggest an IRS Identity Protection PIN. Anyone can get one from the IRS. It stops someone else filing a tax return using their Social Security number.
Warn about the follow-up scams. Nobody from the Department of Education, a scholarship program or a credit bureau will ask for a Social Security number, a password or a payment by email or text. Tell staff to go to official websites directly rather than following links.
Look at your own Social Security number trail. Find where your business stores employee and former-employee Social Security numbers, delete what you are no longer required to keep, and make sure the rest sits in a system with restricted access rather than in spreadsheets and email.
The summary
The Florida Department of Education has not said how its financial aid portal was breached, and may not for some time. What is already clear is that up to 4.9 million people's Social Security numbers were exposed, that the people affected have been told to protect themselves, and that no one has yet been offered help to do it.
If you employ people in Florida, a short message to your staff this week, recommending a credit freeze and warning about the scams that follow, will help more of them than anything the breach notice has done so far.
Sources
- Data breach notice and FAQ — Florida Department of Education
- Florida warns 5 million affected by financial aid site breach — The Record
- 4.9M students potentially affected by Florida student aid portal hack — Miami Herald, via GovTech
- Florida Department of Education warns of data breach affecting nearly 5 million people — Fox 13
- Florida Department of Education financial aid website data breach — CBS Miami
- IdentityTheft.gov: data breaches — US Federal Trade Commission
