Breaches expose millions of students and personnel, according to reports
Recent attacks on government and corporate systems have compromised sensitive data for millions of students, military personnel, and international travelers.
Key figures
| Florida financial aid applicants exposed | 4.9 million |
|---|---|
| Public school students exposed | 5.7 million |
| Estimated Defense Department personnel affected | 4 million |
| Japan Airlines customers exposed | 92,000 |
| JAL customers with passport numbers compromised | 2,000 |
| European businesses hit by disruptions | more than 350 |
Timeline
- Start of unauthorized access to Japan Airlines customer data
- Start of unauthorized access to Defense Manpower Data Center files
- DMDC discovered a flaw in its file-sharing system
- End of unauthorized access to Defense Manpower Data Center files
- Intermittent breach of Educational Testing Service records
- Florida Department of Motor Vehicles reported a breach
- Florida Department of Education became aware of financial aid breach
Surges in attacks targeting public sector databases and corporate vendors have compromised Social Security numbers and military records, increasing the risk of identity theft and foreign intelligence targeting.
Educational leaks hit Florida and California
The Florida Department of Education (FLDOE) reported that unauthorized criminal access to the Florida Student Financial Aid website potentially exposed the data of 4.9 million individuals [2, 8]. The department became aware of the breach on Oct. 19 [2, 11].
Exposed information includes Social Security numbers, names, dates of birth, home addresses, phone numbers, email addresses, and gender identification codes [8, 11]. The FLDOE took the financial aid site down and is partnering with the Florida Department of Law Enforcement and the Florida Digital Service [2].
Separately, a breach at Educational Testing Service (ETS), a standardized testing contractor, exposed the records of approximately 5.7 million public school students from the 2025-2026 academic year [12]. The breach occurred intermittently between May 22 and Sept. 18, 2026 [12].
Reports indicate the ETS leak included names, addresses, dates of birth, student identification numbers, testing scores, and special education accommodations [12].
Pentagon personnel records exposed
The Defense Manpower Data Center (DMDC), which manages records for military personnel and their families, discovered a flaw in its file-sharing system on July 16 [3]. A breach notice dated Sept. 18 shows unauthorized users accessed files containing unencrypted personal information between October 2025 and July 2026 [3].
The Pentagon has not confirmed the total number of affected individuals. Two people familiar with the incident estimated that roughly 4 million Defense Department personnel may be affected [3]. Exposed data included Social Security numbers and, in some cases, military occupational specialties [3].
The Privacy Act requires federal agencies to maintain appropriate safeguards for personal records [3, 6]. Because the files were unencrypted, security experts note the breach could help criminals impersonate service members or allow foreign intelligence services to identify specific personnel [3].
Third-party vulnerabilities impact travel data
A breach at the IT firm Amadeus exposed the data of approximately 92,000 Japan Airlines (JAL) customers [4]. Amadeus notified the airline on Oct. 23 that unauthorized access occurred between Aug. 10, 2023, and Sept. 23, 2026 [4].
Most affected customers had reservation codes, names, flight dates, and routes exposed [4]. However, 2,000 customers also had their passport numbers, email addresses, phone numbers, and frequent flyer numbers compromised [4].
Amadeus provides booking and check-in solutions for over 400 airlines and 210 airport operators [4]. Other carriers, including Korean Air and Asiana Airlines, also confirmed impacts from the same flaw [4].
Attacks move toward infrastructure
The Pentagon is investigating suspected cyberattacks that caused freezer malfunctions at six US military bases in August [5]. At Fort Huachuca, Arizona, a freezer entered defrost mode overnight, spoiling the food stored inside [5].
The Defense Criminal Investigative Service is leading a joint investigation with US Cyber Command and the US Army Criminal Investigation Division [5]. Investigators are coordinating with French authorities after similar disruptions hit more than 350 businesses in Europe [5].
"The target has moved from data to daily life. Hackers can now change how a pump, a valve or a freezer behaves," said Ankush Sabharwal, CEO of CoRover.ai and BharatGPT.ai [5].
Sabharwal also noted the strategic importance of food supply systems, stating, "Logistics wins wars, and food is the most basic logistics" [5].
This activity follows a pattern of government targeting in Florida, where the Department of Motor Vehicles reported a breach by a hacking group in September 2026 [2].
What we don't know
- Who were the attackers responsible for the Florida and Pentagon breaches?
- Did the intruders download and export copies of the Pentagon personnel files, or only view them?
- Were the US military freezer malfunctions caused by a coordinated cyberattack or equipment failure and misconfiguration?
Sources
- Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach — therecord.media, Oct 30, 2026
- Troops Exposed in New Pentagon Data Breach: How Many Were Affected? — military.com, Oct 30, 2026
- Japan Airlines suffers third-party data breach exposing passenger info — BleepingComputer, Oct 29, 2026
- As Pentagon Probes Freezer Malfunctions As Cyberattack, Experts Explain The Bigger Implications — timesnownews.com, Oct 30, 2026
- 5.7 Million Students Exposed: Why This Breach Demands Immediate Legal Action - The Tech Edvocate — thetechedvocate.org
