HackingFinancial ServicesFinanceVulnerability ExploitTargetedIdentity (basic)Government IDHighContained

Edfinancial Services, LLC

bd_435af980ea795522 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 21, 2022

Filed

Aug 26, 2022

To disclose

5 weeks

Affected

4,229state residents only

Linked

2 filings

Confidence

63%

Full breach record for Edfinancial Services, LLC →

Edfinancial Services, LLC notified Hawaii regulators of a data incident involving its third-party servicer Nelnet. Unauthorized access occurred between June 2022 and July 22, 2022, via a vulnerability in Nelnet's system. Impacted data included names, addresses, emails, phone numbers, and SSNs. No financial account numbers were compromised. Edfinancial offered 24 months of credit monitoring and is cooperating with law enforcement.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 50 days

discovery → filing · 5 weeks / 36 days

Jun 1, 2022

Begins

Jul 21, 2022

Discovered

Aug 26, 2022

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_da947de277a64c702022-09-01 · +6dVerified

Name: Edfinancial Services, LLC
norm: edfinancial services

Name: Edfinancial Services, LLC
norm: edfinancial services
Industry: Financial Servicesllm

Discovered: Jul 21, 2022
Breach occurred: Jun 1, 2022 – Jul 22, 2022
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 26, 2022
Affected individuals: 4,229state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: notified the U.S. Department of Education who in turn notified law enforcement
Initial access: exploit_public_facing

During the incident: Nelnet informed us that its cybersecurity team took immediate action to secure the information system, block the suspicious activity, fix the issue, and launched an investigation with third-party forensic experts
We are notifying potentially impacted individuals
Offering you immediate access to credit monitoring and identity theft protection services for 24 months at no cost to you, through Experian
Notified the U.S. Department of Education who in turn notified law enforcement
We are fully cooperating with the law enforcement investigations
Changes made: Fix the issue
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: HI CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Hawaii State AGAug 26 · first · this page

New Hampshire State AG+6d

Pattern: first filing Aug 26 (HI), last Sep 1 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://cca.hawaii.gov/wp-content/uploads/2026/05/2022-1495.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 26, 2022
Raw hash: ffd08ce8fa6c28984a238bc15a20c18fc9499c1489367767427109899dffa8df

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityEdfinancial Services, LLC

Victim entityEdfinancial Services, LLC

Incidentdiscovered Jul 21, 2022

Stated responseNelnet informed us that its cybersecurity team took immediate action to secure the information system, block the suspicious activity, fix the issue, and launched an investigation with third-party forensic experts

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenancecca.hawaii.gov