Nelnet Data Breach Exposes 2.5 Million Student Loan Records
A vulnerability in Nelnet's loan servicing system exposed personal data. Here's what that means for borrowers.
Key points
- Over 2.5 million student loan borrowers had their personal data exposed between June and July 2022.
- The breach was discovered by Nelnet Servicing on August 17, 2022.
- Exposed data includes names, addresses, emails, phone numbers, and social security numbers.
- Financial information was not accessed, but personal data could fuel phishing attacks.
EdFinancial and the Oklahoma Student Loan Authority are letting over 2.5 million loan holders know that their personal information was exposed. This breach, first reported by Threatpost, involves Nelnet Servicing, the company that provides the online systems and portals for these loan services.
Nelnet, based in Lincoln, Nebraska, revealed the breach occurred between June 1 and July 22, 2022. They notified affected individuals on July 21, 2022, though the breach's full scope became clear only on August 17, 2022.
The exposed data includes names, home and email addresses, phone numbers, and social security numbers. Although no financial information was accessed, the stolen personal data could be used in scams. Phishing, where criminals send fake emails to trick people into handing over more sensitive information, is a likely risk.
How did the hackers get in?
Nelnet found a vulnerability, or weakness, in their system that allowed unauthorized access. They have not publicly clarified the specific flaw, but once noticed, Nelnet's cybersecurity team quickly moved to secure their system and block any suspicious activity. They also hired outside experts to understand the full scope of the breach.
Melissa Bischoping, an endpoint security expert at Tanium, warns that this breach could lead to phishing attacks, especially with the recent news of federal student loan forgiveness. Scammers might use this as a chance to impersonate trusted brands and trick students and graduates into giving up more personal information.
Nelnet is offering two years of free credit monitoring and up to $1 million in identity theft insurance to those affected. This step aims to help mitigate potential misuse of stolen data.
For people who have loans serviced by Nelnet, be cautious of unexpected emails or calls asking for personal details. Always contact the company directly through official channels if in doubt.
