Florida’s Department of Education says personal information belonging to as many as 4.9 million people was vulnerable in a breach of its financial-aid website. That information included Social Security numbers.

The agency says financial-aid payments themselves are not at risk. That is welcome news. It would be even more welcome if it arrived without the possibility that somebody else had been browsing the information attached to the people receiving them.

According to the Florida Phoenix, the department learned about the breach on October 19 and announced it on October 29. Those are the discovery and announcement dates. They do not establish how long the intrusion lasted.

The Phoenix asked that question. The department’s response did not provide a duration.

It did provide some activities.

Monitor your accounts. Review credit reports. Consider fraud alerts or credit freezes. Here are the credit bureaus. Here are the resources. Please enjoy your new unpaid position as assistant regional manager of making sure you are still you.

The advice is sensible. That is what makes the whole arrangement so infuriating. People may genuinely need to do this work. The agency has not simply sent a useless brochure. It has handed families a potentially useful chore list they did not fucking need yesterday.

You came to the financial-aid website because education is expensive. Congratulations: you may now get to spend additional time checking whether a stranger has become financially ambitious in your name.

Can the Department of Education at least issue a certificate in Advanced Refreshing of Account Statements? No. The diploma would probably require another form.

The Daily Heckler: five or six selected stories.
Political satire for your morning inbox.

The department says it acted swiftly to stop the unauthorized access and secure its systems. It is investigating the scope and believes the incident was limited to the financial-aid website.

Those qualifications matter. We do not know that all 4.9 million people had their identities stolen. We do not know the final scope. Uncertainty is not permission to invent a bigger disaster.

Uncertainty is also not particularly relaxing when it concerns your Social Security number, which follows you around like a deeply boring tattoo, except banks keep asking to see it.

And now, and now, the people who entrusted information to a government website are supposed to keep an eye out for suspicious activity somewhere else. The system has developed a wonderful division of labor: the agency investigates its systems; you investigate your life.

I am so tired of the cheerful efficiency with which institutions distribute the cleanup instructions.

Who is measuring the hours families spend doing this? Where does that time appear in the incident report? Is there a column for the parent sitting at the kitchen table after work, trying to figure out whether another online notice is useful, fraudulent or merely announcing that yet another password has expired?

The department says it takes the security of student and family information seriously. Good. The families now have every reason to take it seriously too.

They were hoping the state had already done that part before assigning the homework.