HackingFinancial ServicesTechnologyFinanceVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHighContained

Nelnet Servicing, LLC

bd_d9779d4110fe5fb0 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 21, 2022

Filed

Aug 26, 2022

To disclose

5 weeks

Affected

35,151state residents only

Linked

8 filings

Confidence

71%

Full breach record for Nelnet Servicing, LLC →5 incidents on file

Nelnet Servicing, LLC reported a cyberattack affecting student loan borrowers of Edfinancial and OSLA. Unauthorized access occurred from June 1 to July 22, 2022, involving names, addresses, SSNs, and phone numbers. Nelnet discovered the vulnerability on July 21, 2022, engaged forensic experts, and notified law enforcement. Notices were sent to affected individuals on August 26, 2022, offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 50 days

discovery → filing · 5 weeks / 36 days

Jun 1, 2022

Begins

Jul 21, 2022

Discovered

Aug 26, 2022

Filed

vs. sector median

4 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Maine State AGbd_0688f7b4eb4034572022-08-26Candidate
California State AGbd_0c865b6ff7a994012022-08-26Verified
Massachusetts State AGbd_71f17f12d7b6ff892022-08-26Verified
Oregon State AGbd_c4bf8713950421552022-08-26Candidate

Show 3 more filings ↓

Indiana State AGbd_d3d9e4c7f4e182af2022-08-26Verified
Delaware State AGbd_e7ee505dd12577332022-08-26Verified
Montana State AGbd_f14dfc83cd118c032022-08-26Verified

Name: Nelnet Servicing, LLC
norm: nelnet servicing

Name: Nelnet Servicing, LLC
norm: nelnet servicing
Industry: Financial ServicesllmTechnologyllm

Discovered: Jul 21, 2022
Breach occurred: Jun 1, 2022 – Jul 22, 2022
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 26, 2022
Affected individuals: 35,151state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the U.S. Department of EducationNotified federal law enforcement
Initial access: exploit_public_facing

During the incident: Secured the information system
Blocked the suspicious activity
Fixed the issue
Launched an investigation with third-party forensic experts
Notified the U.S. Department of Education
Notified federal law enforcement
Provided access to credit monitoring services for 24 months through Experian IdentityWorks
Changes made: Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing information on how to place a fraud alert and security freeze on one’s credit file
Providing information on protecting against tax fraud
Providing contact details for the national consumer reporting agencies
Providing information on how to obtain a free credit report
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Maine State AGAug 26 · first

California State AGAug 26 · first

Massachusetts State AGAug 26 · first

Oregon State AGAug 26 · first

Indiana State AGAug 26 · first

Delaware State AGAug 26 · first

Montana State AGAug 26 · first

Washington State AGAug 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA14820.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 26, 2022
Raw hash: 4cc632e0ffa7d2cf464cb00f759a0ef65347a350acf663dd84f478c1921ea739

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityNelnet Servicing, LLC

Victim entityNelnet Servicing, LLC

Incidentdiscovered Jul 21, 2022

Stated responseSecured the information system

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com