About 2,501,324 individuals have been affected by a breach in the network of Nelnet Servicing, a technology services providing company. The malicious actors have stolen data about student loan accounts from Oklahoma Student Loan Authority (OSLA) and EdFinancial, two clients of Nelnet Servicing.
Oklahoma Student Loan Authority and EdFinancial were using technology solutions from Nelnet Servicing to give people online access to their student loan accounts.
Hackers breached the systems, probably after exploiting a vulnerability, sometime in June 2022, but they were not identified and they lingered on the network until July 22.
What Data Was Stolen
“A sample notification letter to impacted parties sent to the Office of the Maine Attorney General as part of the data breach disclosure process, Nelnet Servicing has informed OSLA and EdFinancial, who are notifying their customers.”, according to BleepingComputer.
Although Nelnet blocked the cyberattack as quickly as possible after it was detected, a further investigation showed on August 17 that some student loan account registration information might have been used.
The exposed data include: the full name of the customer, the physical address as well as the email address, phone number and social security number.
EdFinancial also underlines that not all its clients are hosted by Nelnet Servicing, so not all students that took a loan through them are impacted by the data breach.
How the Victims Can Protect Themselves
Although the letters clarify that no information about financial account numbers or payment details were exposed due to the data breach, hackers could start further attacks with the data they have.
The cybercriminals that obtained the stolen data could start phishing attacks, social engineering, online impersonation, and various scamming schemes.
Both EdFinancial and OSLA offer impacted individuals free access to a 24-month identity theft protection service through Experian, with instructions on how to enroll enclosed in the letters.
Victims are recommended to take immediate action to protect themselves from fraud by:
- enlisting in Experian’s IdentityWorks service
- showing vigilance against all incoming communication
- closely monitoring bank account statements
- demanding a credit report
- placing a credit freeze
Because this cybecrime was of such magnitude, legal action is taken into consideration. The law firm “Markovits, Stock & DeMarco” announced an investigation that could transform in a class action lawsuit.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, Youtube, and Instagram for more cybersecurity news and topics.