HackingFinancial ServicesFinanceVulnerability ExploitData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDHighContained

Edfinancial Services, LLC

bd_f14dfc83cd118c03 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 21, 2022

Filed

Aug 26, 2022

To disclose

5 weeks

Affected

7,408state residents only

Linked

8 filings

Confidence

65%

Edfinancial Services, LLC notified consumers of a cybersecurity incident involving its third-party servicer, Nelnet Servicing, LLC. An unknown party accessed student loan account registration information (name, address, email, phone, SSN) between June 2022 and July 22, 2022, via a vulnerability discovered by Nelnet on July 21, 2022. Edfinancial engaged forensic experts, cooperated with law enforcement, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 50 days

discovery → filing · 5 weeks / 36 days

Jun 1, 2022

Begins

Jul 21, 2022

Discovered

Aug 26, 2022

Filed

vs. sector median

4 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Maine State AGbd_0688f7b4eb4034572022-08-26Candidate
California State AGbd_0c865b6ff7a994012022-08-26Verified
Massachusetts State AGbd_71f17f12d7b6ff892022-08-26Verified
Oregon State AGbd_c4bf8713950421552022-08-26Candidate

Show 3 more filings ↓

Indiana State AGbd_d3d9e4c7f4e182af2022-08-26Verified
Washington State AGbd_d9779d4110fe5fb02022-08-26Verified
Delaware State AGbd_e7ee505dd12577332022-08-26Verified

Name: Edfinancial Services, LLC
norm: edfinancial services

Name: Edfinancial Services, LLC
norm: edfinancial services
Industry: Financial Servicesllm

Discovered: Jul 21, 2022
Breach occurred: Jun 1, 2022 – Jul 22, 2022
Undetected for: 50 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 26, 2022
Affected individuals: 7,408state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: notified the U.S. Department of Educationnotified law enforcement
Third party: via Nelnet Servicing, LLC
Initial access: exploit_public_facing

During the incident: Nelnet informed us that its cybersecurity team took immediate action to secure the information system, block the suspicious activity, fix the issue, and launched an investigation with third-party forensic experts
Notified the U.S. Department of Education who in turn notified law enforcement
Fully cooperating with the law enforcement investigations
Offering you immediate access to credit monitoring and identity theft protection services for 24 months at no cost to you, through Experian
Changes made: Secure the information system
Block the suspicious activity
Fix the issue
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Maine State AGAug 26 · first

California State AGAug 26 · first

Massachusetts State AGAug 26 · first

Oregon State AGAug 26 · first

Indiana State AGAug 26 · first

Washington State AGAug 26 · first

Delaware State AGAug 26 · first

Montana State AGAug 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-521.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 26, 2022
Raw hash: cd7c2410dfdefe6fe14b577351187cb830b86402de20d32aae00fb0f376f3a18

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityEdfinancial Services, LLC

Victim entityEdfinancial Services, LLC

Incidentdiscovered Jul 21, 2022

Stated responseNelnet informed us that its cybersecurity team took immediate action to secure the information system, block the suspicious activity, fix the issue, and launched an investigation with third-party forensic experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov