HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTHighContained
Nelnet Servicing, LLC Class Action Settlement
bd_e7ee505dd1257733 · schema v1 · pii pii-v1
Full breach record for Nelnet Servicing, LLC Class Action Settlement →Nelnet Servicing, LLC disclosed a data event affecting student loan borrowers of Edfinancial and OSLA. An unknown party accessed registration information (name, address, email, phone, SSN) via a vulnerability in Nelnet's portal between June 22 and July 22, 2022. Approximately 8,425 Delaware residents were notified starting August 26, 2022. Nelnet engaged forensic experts, secured systems, and notified the Department of Education and law enforcement. Affected individuals received 24 months of credit monitoring.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_0c865b6ff7a99401California State AGfiled 2022-08-26Candidate
Source provenance
- Source URL
- https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2022/09/Nelnet-Servicing-Notice-of-Data-Event-DE-Exhibit-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 26, 2022
- Raw hash
- d7cb4783fcc89a005b5749c52388be85275e33f3eb1942bd985e6676416f1579
Reporting entity
- Name
- Nelnet Servicing, LLC Class Action Settlementnorm: nelnet servicing llc class action settlement
- Domain
- nelnetsettlement.com
Victim entity
- Name
- Nelnet Servicing, LLC Class Action Settlementnorm: nelnet servicing llc class action settlement
- Domain
- nelnetsettlement.com
Incident
- Discovered
- Jul 21, 2022
- Materiality determined
- —
- Notification sent
- Aug 26, 2022
- Affected individuals
- 8,425
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified the U.S. Department of Education, which in turn notified law enforcementProviding written notice of this incident to relevant state and federal regulators, as necessary
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 5 weeks(36 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.