HackingFinancial ServicesFinanceVulnerability ExploitCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDMediumContained

Nelnet Servicing, LLC

bd_0c865b6ff7a99401 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 21, 2022

Filed

Aug 26, 2022

To disclose

5 weeks

Affected

Not disclosed

Linked

8 filings

Confidence

63%

Full breach record for Nelnet Servicing, LLC →5 incidents on file

Nelnet Servicing, LLC, a student loan servicing provider, disclosed that an unknown party accessed student loan account registration information (name, address, email, phone, SSN) between June 1 and July 22, 2022, due to a vulnerability discovered on July 21, 2022. The incident affected customers of Edfinancial Services, Oklahoma Student Loan Authority, and others using Nelnet's systems. Nelnet secured the system, engaged forensic experts, and notified regulators and law enforcement. Affected individuals are offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 21, 2022 → Notified Aug 26, 202236d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 50 days

discovery → filing · 5 weeks / 36 days

Jun 1, 2022

Begins

Jul 21, 2022

Discovered

Aug 26, 2022

Filed

vs. sector median

4 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Maine State AGbd_0688f7b4eb4034572022-08-26Candidate
Massachusetts State AGbd_71f17f12d7b6ff892022-08-26Verified
Oregon State AGbd_c4bf8713950421552022-08-26Candidate
Indiana State AGbd_d3d9e4c7f4e182af2022-08-26Verified

Show 3 more filings ↓

Washington State AGbd_d9779d4110fe5fb02022-08-26Verified
Delaware State AGbd_e7ee505dd12577332022-08-26Verified
Montana State AGbd_f14dfc83cd118c032022-08-26Verified

Name: Nelnet Servicing, LLC
norm: nelnet servicing

Name: Nelnet Servicing, LLC
norm: nelnet servicing
Industry: Financial Servicesllm

Discovered: Jul 21, 2022
Breach occurred: Jun 1, 2022 – Jul 22, 2022
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 26, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the U.S. Department of EducationNotified law enforcement
Third party: via Nelnet Servicing, LLC
Initial access: exploit_public_facing

During the incident: Secured the information system
Blocked the suspicious activity
Fixed the issue
Launched an investigation with third-party forensic experts
Notified the U.S. Department of Education
Notified law enforcement
Offering immediate access to credit monitoring and identity theft protection services for 24 months at no cost to you, through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: CA 60-day OK · 36d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 21, 2022
→ Notified: Aug 26, 2022
36d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 21, 2022 → Notified: Aug 26, 2022	36d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Maine State AGAug 26 · first

Massachusetts State AGAug 26 · first

Oregon State AGAug 26 · first

Indiana State AGAug 26 · first

Washington State AGAug 26 · first

Delaware State AGAug 26 · first

Montana State AGAug 26 · first

California State AGAug 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-556689
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 26, 2022
Raw hash: d8da5e8efbb7a4a654c4684e870c8b3cc3ee2be5faa6b8da5e2e6c139449af0c

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityNelnet Servicing, LLC

Victim entityNelnet Servicing, LLC

Incidentdiscovered Jul 21, 2022

Stated responseSecured the information system

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov