The Florida Department of Education's financial-aid website remained unavailable Thursday during its response to a cyberattack potentially affecting 4.9 million people.
The department said financial-aid disbursements and tuition payments would not be delayed, and scholarship, grant and student-loan eligibility would not change.
The department said staff discovered unauthorized access to FloridaStudentFinancialAidSG.org on Oct. 19. Its breach FAQ says Social Security numbers were among the compromised information. Officials believe the breach was limited to that website, and the estimate of affected people remains preliminary.
The financial-aid website displayed a maintenance message when DysruptionHub checked it Thursday. The department warned that its response could temporarily disrupt websites and online services.
The breach emerged amid concern over PHP2Shell, two PHP vulnerabilities that can allow attackers to run code remotely without authentication. Amazon observed exploitation attempts as early as Oct. 17. The department has not identified the software involved in its breach or linked the incident to those vulnerabilities.
In a statement Thursday, the department said it stopped the unauthorized activity and secured its systems. It is working with the Florida Digital Service and Florida Department of Law Enforcement and notified the state attorney general.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
Officials have not disclosed when the intrusion began or how attackers gained access.
The incident follows a September financial-aid disruption in Mississippi, where the public university system's central aid office was affected but its online application portal remained available.
Florida's FAQ recommends monitoring credit and reviewing protective options. The department has not given a date for complete website restoration.
