Florida Got Breached Twice in Six Weeks. The Second One Took Your ID Photos.

The number in the headline is 4.9 million, and the first thing to understand about it is that it is a ceiling, not a count.

Florida's Department of Education said as many as 4.9 million people may have been affected by a breach of its student financial aid website. Its own FAQ walks that number back, carefully: not everyone whose information was in the system was necessarily affected, and the types of personal information involved may differ from one person to another. So the real story is not "4.9 million people were breached." The real story is what was in that system, and it is the part that should make you uncomfortable.

Two incidents, one state, six weeks apart

Here is the verified sequence.

October 19, 2026: FLDOE staff became aware of unauthorized criminal access to the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org). The department activated its cybersecurity response, contained the activity, secured the systems, notified the Florida Attorney General's Office, and brought in the Florida Department of Law Enforcement and the Florida Digital Service. It announced publicly on October 29. The incident remains an ongoing criminal investigation, and the department has not identified a suspect or said how the intrusion occurred. What was taken: Social Security numbers. Plus, per the agency's notice and FAQ, first and last names, dates of birth, home addresses, telephone numbers, email addresses, and gender identification codes. The breach is believed to be limited to the financial aid website. Current financial aid is not at risk: the department said disbursements and tuition payments will not be delayed and eligibility for scholarships, grants, or student loans is unaffected. September 4, 2026, six weeks earlier: FLHSMV, the Florida Department of Highway Safety and Motor Vehicles, learned that a malicious actor had accessed department records using compromised credentials. The credentials belonged to an employee of a local Florida law enforcement agency, who had improperly stored them on an electronic device. The information potentially affected includes driver license and motor vehicle data, to include document images, and other personal information. On October 16 the department issued a statewide news release, began mailing letters to current license and ID holders, and is offering one year of complimentary identity and credit monitoring through Sontiq, a TransUnion company, plus $1 million in identity theft insurance. FLHSMV says it has no evidence the information has been misused.

The data that got taken is application data

Stop and look at the FLDOE field list again. Name, date of birth, home address, phone number, email, Social Security number.

That is not a database schema someone built to store secrets. That is the exact field set you type into a form, over and over, for the rest of your life. Credit application. Job application. Bank account. Rental application. Insurance claim. The financial aid portal was one of maybe a hundred places you handed in the same six-field block, and it became a target for exactly the reason a pool becomes a target: it held 4.9 million copies of the same block in one place, behind one set of servers.

When the pool is hit, every copy you sent is retroactively part of the story. Your SSN is not "in" the FLDOE breach and also "in" your landlord's inbox. Your SSN is one number, and it is now sitting in a number of places that all just got slightly less trustworthy.

The part worth pausing on: "document images"

The DMV breach is where this stops being a fields-and-dates story. FLHSMV's own notice says the potentially affected data includes driver license and motor vehicle data, to include document images. Not data about your license. Images of your license. Scans. The same artifacts you would photograph, email, or upload to a landlord, an employer's onboarding portal, a hospital, a car dealer, a background check service.

A fields breach tells an attacker what to guess about you. A document-image breach hands them the actual paper, in its original layout, with the real signature and the real photo on it. That is the difference between a sketch and a portrait.

And here is the uncomfortable geometry of it: the state's copy was stolen from the largest, best-defended copy in existence. That tells you nothing about the copies you sent to a property manager who keeps documents in a shared drive, or an HR firm that keeps them in a mailbox, or a hospital registrar that keeps them on a laptop. Those are the same honeypot shape, at a smaller scale, with a thinner wall.

The honeypot shape is the story

This is the third time this year we have watched a state-scale or enterprise-scale breach of data that is already in circulation in smaller copies you control. The Lennar breach exposed the exact document set a homebuyer was already emailing to a dozen people. The DMDC breach exposed service-member fields you hand to employers and benefits providers in ordinary documents. This time it is Florida, twice, and one of the two took the actual images.

The shape is identical every time, and it is the shape that matters more than any single incident:

The big database gets hit. You did nothing. You cannot fix it.

The same data and the same documents exist in a pile of smaller copies you did send, to people whose security you have zero visibility into.

Those copies outlive the incident. They sit in inboxes and shared folders for years. They are the ones that keep being the weak link, incident after incident.

You cannot redact FLDOE's servers. You cannot redact FLHSMV's. Pretending otherwise would be exactly the overclaim this blog should not be making. What you can do is change the third step: the number and the completeness of the copies you put into the world. Every full, unredacted ID, pay stub, bank statement, and lease that you send is one more honeypot carrying your six-field block and your document images. Fewer of them, and fewer complete fields per one, means a smaller surface for the next September 4 and the next October 19.

What to actually do

If you applied for Florida student aid, or you hold or once held a Florida driver's license or ID card:

• Read the official notices. fldoe.org/databreach and FLHSMV.gov/DataBreach. Note what applies to you.
• Enroll in the monitoring being offered. If FLHSMV mailed you a letter, the one year of credit monitoring and the $1 million in identity theft insurance are on the table. Take them. FLDOE is not offering monitoring in this notice, so your protection there is the next three steps.
• Fraud alert or freeze. This is FLDOE's own recommendation, not ours. A fraud alert is the quick one. A security freeze is the strong one, and with an SSN this widely circulated it is the one worth doing while you figure out what else is out there.
• Pull the free report. AnnualCreditReport.com, or 1-877-322-8228. Check for accounts you did not open and inquiries you do not recognize.
• Shrink what you send from here on out. Next rental application, next job application, next loan file: redact the fields the other side does not need. SSN when they only need name and income. Account numbers when they only need the balance line. The whole family block when they only need yours.

That last step is the one this site exists for. It is not a defense against a server you never controlled. It is a decision about how many other servers your full, unredacted self already lives on. You can see how it works on an ID, on a pay stub, on a bank statement, or on the full document set a landlord asks for. The file runs in your browser, nothing uploads, nothing is stored, and it is free to try. For unlimited redactions, plans and pricing are here.

Florida got hit twice in six weeks. The state is working on its side. The copies are yours to cut.

---

Related: Redact an ID online · Redact a pay stub · Redact bank statements · Landlord document guide · Redact documents online

Ready to cut a copy before it travels? Redact a document in your browser: nothing uploads, nothing is stored, free to try. For unlimited redactions, check out plans and pricing.