Student Loan Breach Exposes 2.5M Records

Share this article:
2.5 million people were affected, in a breach that could spell more trouble down the line.
EdFinancial and the Oklahoma Student Loan Authority (OSLA) are notifying over 2.5 million loanees that their personal data was exposed in a data breach.
The target of the breach was Nelnet Servicing, the Lincoln, Neb.-based servicing system and web portal provider for OSLA and EdFinancial, according to a breach disclosure letter.
Nelnet revealed the breach to affected loan recipients on July 21, 2022 via a letter.
“[Our] cybersecurity team took immediate action to secure the information system, block the suspicious activity, fix the issue, and launched[sic] an investigation with third-party forensic experts to determine the nature and scope of the activity,” according to the letter.
By August 17th, the investigation determined that personal user information was accessed by an unauthorized party. That exposed information included names, home addresses, email addresses, phone numbers and social security numbers for a total of 2,501,324 student loan account holders. Users’ financial information was not exposed.
According to a breach disclosure filing submitted by Nelnet’s general counsel, Bill Munn, to the state of Maine the breach occurred sometime between June 1, 2022 and July 22, 2022. However, a letter to affected customers pinpoints the breach to July 21. The breach was discovered on August 17, 2022.
“On July 21, 2022, Nelnet Servicing, LLC (Nelnet), our servicing system and customer website
portal provider, notified us that they had discovered a vulnerability that we believe led to this incident,” according to the Nelnet.
It’s unclear what the vulnerability was.
“On August 17, 2022, this investigation determined that certain student loan account registration information was accessible by an unknown party beginning in June 2022 and ending on July 22, 2022,” according to the letter.
Although users’ most sensitive financial data was protected, the personal information that was accessed in the Nelnet breach “has potential to be leveraged in future social engineering and phishing campaigns,” explained Melissa Bischoping, endpoint security research specialist at Tanium, in a statement via email.
“With recent news of student loan forgiveness, it’s reasonable to expect the occasion to be used by scammers as a gateway for criminal activity,” Bischoping said.
Last week, the Biden administration announced a plan to cancel $10,000 of student loan debt for low- and middle-income loanees. She said the loan forgiveness program will be used to lure victims into opening up phishing emails.
She warns that recently breached data will be used to impersonate affected brands in waves of phishing campaigns targeting students and recent college graduates.
“Because they can leverage the trust from existing business relationships they can be particularly deceptive,” she wrote.
According to the breach disclosure Nelnet Servicing informed Edfinancial and OSLA that Nelnet Servicing’s cybersecurity team “took immediate action to secure the information system, block the suspicious activity, fix the issue, and launched an investigation with third-party forensic experts to determine the nature and scope of the activity.”
Remediation also included two years of free credit monitoring, credit reports and up to $1 million in identity theft insurance.
Share this article:
Networking giant says attackers gained initial access to an employee’s VPN client via a compromised Google account.
Attacks against U.S. companies spike in Q1 2022 with patchable and preventable external vulnerabilities responsible for bulk of attacks.
Upsurge in the tourism industry after the COVID-19 pandemic grabs the attention of cybercriminals to scam the tourists.

document.getElementById( “ak_js_1” ).setAttribute( “value”, ( new Date() ).getTime() );
This site uses Akismet to reduce spam. Learn how your comment data is processed.
Tens of thousands of cameras have failed to patch a critical, 11-month-old CVE, leaving thousands of organizations…
2 weeks ago
The First Stop For Security News
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.


Back to list