HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICLowContained
Nelnet Campus Commerce
bd_f8aaef8aa5a5d8ff · schema v1 · pii pii-v1
Full breach record for Nelnet Campus Commerce →Nelnet Campus Commerce experienced a data breach involving unauthorized access to its Tuition Management System (TMS) platform. Between January 17 and 19, 2022, an unauthorized individual accessed and downloaded reports containing student and authorized payer names. The breach affected individuals across multiple US states, including California, New York, and Maryland. Nelnet secured the application, engaged forensic specialists, notified law enforcement, and offered 24 months of credit monitoring via Experian to affected individuals.
California clockDiscovered Jan 19, 2022 → Notified Feb 18, 202230d ✓ CA 60-day OK4 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_87291d77b11e7de6Maine State AGfiled 2022-02-18Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-551081
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 18, 2022
- Raw hash
- f64594add60c242dcf3358c586a183c4232fa8f355db719ce72213bb54e62594
Reporting entity
- Name
- Nelnet Campus Commercenorm: nelnet campus commerce
Victim entity
- Name
- Nelnet Campus Commercenorm: nelnet campus commerce
Incident
- Discovered
- Jan 19, 2022
- Materiality determined
- —
- Notification sent
- Feb 18, 2022
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 4 weeks(30 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jan 19, 2022→ Notified: Feb 18, 202230d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.