HackingFinancial ServicesTechnologyFinanceVulnerability ExploitCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDHighContained

Nelnet Servicing, LLC

bd_e7ee505dd1257733 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 21, 2022

Filed

Aug 26, 2022

To disclose

5 weeks

Affected

8,425state residents only

Linked

8 filings

Confidence

64%

Full breach record for Nelnet Servicing, LLC →5 incidents on file

Nelnet Servicing, LLC disclosed a data event affecting student loan borrowers of Edfinancial and OSLA. An unknown party accessed registration information (name, address, email, phone, SSN) via a vulnerability in Nelnet's portal between June 22 and July 22, 2022. Approximately 8,425 Delaware residents were notified starting August 26, 2022. Nelnet engaged forensic experts, secured systems, and notified the Department of Education and law enforcement. Affected individuals received 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 50 days

discovery → filing · 5 weeks / 36 days

Jun 1, 2022

Begins

Jul 21, 2022

Discovered

Aug 26, 2022

Filed

vs. sector median

4 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Maine State AGbd_0688f7b4eb4034572022-08-26Candidate
California State AGbd_0c865b6ff7a994012022-08-26Verified
Massachusetts State AGbd_71f17f12d7b6ff892022-08-26Verified
Oregon State AGbd_c4bf8713950421552022-08-26Candidate

Show 3 more filings ↓

Indiana State AGbd_d3d9e4c7f4e182af2022-08-26Verified
Washington State AGbd_d9779d4110fe5fb02022-08-26Verified
Montana State AGbd_f14dfc83cd118c032022-08-26Verified

Name: Nelnet Servicing, LLC
norm: nelnet servicing

Name: Nelnet Servicing, LLC
norm: nelnet servicing
Industry: Financial ServicesllmTechnologyllm

Discovered: Jul 21, 2022
Breach occurred: Jun 1, 2022 – Jul 22, 2022
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 26, 2022
Affected individuals: 8,425state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the U.S. Department of Education, which in turn notified law enforcementProviding written notice of this incident to relevant state and federal regulators, as necessary
Initial access: exploit_public_facing

During the incident: Nelnet Servicing’s cybersecurity team took immediate action to secure the information system, block the suspicious activity, fix the issue, and launched an investigation with third-party forensic experts
Notified the U.S. Department of Education, which in turn notified law enforcement
Providing access to credit monitoring services for 24 months through Experian IdentityWorks to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing written notice of this incident to relevant state and federal regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing individuals with information on protecting against tax fraud
Providing individuals with contact details for the national consumer reporting agencies
Providing individuals with information on how to obtain a free credit report
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Maine State AGAug 26 · first

California State AGAug 26 · first

Massachusetts State AGAug 26 · first

Oregon State AGAug 26 · first

Indiana State AGAug 26 · first

Washington State AGAug 26 · first

Montana State AGAug 26 · first

Delaware State AGAug 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2022/09/Nelnet-Servicing-Notice-of-Data-Event-DE-Exhibit-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 26, 2022
Raw hash: d7cb4783fcc89a005b5749c52388be85275e33f3eb1942bd985e6676416f1579

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityNelnet Servicing, LLC

Victim entityNelnet Servicing, LLC

Incidentdiscovered Jul 21, 2022

Stated responseNelnet Servicing’s cybersecurity team took immediate action to secure the information system, block the suspicious activity, fix the issue, and launched an investigation with third-party forensic experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov