Nelnet Data Breach Exposes 2.5 Million Student Loan Records

Key points

• Over 2.5 million student loan borrowers had personal data exposed between June and July 2022.
• The breach was discovered on August 17, 2022, weeks after Nelnet first flagged a vulnerability.
• Exposed data includes names, addresses, phone numbers and social security numbers.
• Financial information was not accessed, but the exposed records are ripe for phishing campaigns.

EdFinancial and the Oklahoma Student Loan Authority are notifying more than 2.5 million loan holders that their personal information was compromised. The target was Nelnet Servicing, the Lincoln, Nebraska company that runs the online portals and account systems for both lenders.

Nelnet sent letters to affected borrowers on July 21, 2022. The breach itself ran from June 1 to July 22, 2022, according to a disclosure filed with the state of Maine by Nelnet's general counsel, Bill Munn. The full picture didn't emerge until August 17, when forensic investigators confirmed that an unknown party had accessed 2,501,324 accounts.

How did the hackers get in?

A vulnerability in Nelnet's system let an unauthorised party in. That's where the public record stops: Nelnet hasn't described the specific flaw. Once the intrusion surfaced, its cybersecurity team moved to contain the activity, patch the issue and bring in third-party forensic experts to scope the damage.

The records taken, names, home and email addresses, phone numbers, social security numbers, stop short of financial data. Cold comfort, but it matters: what was taken is exactly the kind of profile that makes a phishing email convincing.

Melissa Bischoping, endpoint security research specialist at Tanium, said in an emailed statement that the stolen data "has potential to be leveraged in future social engineering and phishing campaigns." She flagged the timing: the Biden administration had just announced plans to cancel $10,000 in student loan debt for low- and middle-income borrowers, and scammers rarely miss that kind of opening. Impersonating a trusted lender, backed by real account details, is far more persuasive than a cold phishing attempt. Our coverage of the Kubota breach in July 2026 showed the same playbook: quiet access, personal identifiers harvested, staff unaware for weeks.

Should you worry?

If you hold loans with EdFinancial or OSLA, the answer is a qualified yes. Nelnet is offering two years of free credit monitoring and up to $1 million in identity theft insurance to affected borrowers. Take it.

Be sceptical of any unsolicited contact about student loan forgiveness, whether by email or phone. Verify requests through official channels only. The loan forgiveness news cycle gave scammers a ready-made lure, and they will use it.

The practical watch item here isn't the breach itself. It's the phishing wave that follows months later, once the data has been packaged and sold. Borrowers who act now on credit monitoring are buying a margin of warning, not a guarantee.