Nelnet Servicing nelnet.net

Nelnet Servicing data breach: what happened and what to do

A vulnerability at student loan servicer Nelnet Servicing let an unknown party access borrower registration data from June to July 22, 2022. About 2.5 million EdFinancial and OSLA borrowers were affected. Names, addresses, emails, phone numbers and Social Security numbers were exposed.

View all 13,177 breaches
Breach date
Jun 2022
Made public
26 Aug 2022
Affected
2,501,324
Data exposed
Names, Physical addresses, Email addresses, Phone numbers, Social security numbers
Last updated

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Nelnet Servicing told its clients EdFinancial and the Oklahoma Student Loan Authority (OSLA) on July 21, 2022 that it had found a vulnerability. Its investigation, completed August 17, 2022, found that student loan account registration information was accessible to an unknown party from June 2022 until July 22, 2022.

A filing with Maine's attorney general lists 2,501,324 people in total. Washington's attorney general list shows 35,151 Washington residents, but that is one state's share, not the total.

Sources checked: databreaches.net, atg.wa.gov, consumer.ftc.gov

Last verified against the official page:

How we research this Report an error

What was exposed

The data was names, addresses, email addresses, phone numbers and Social Security numbers. Nelnet said the incident did not affect financial account numbers or payment information.

With that data, criminals can run phishing that names your loan servicer, and a Social Security number can be used for identity theft. Security researchers warned at the time that student loan relief news made borrowers an easy target for scams.

The company's response

Nelnet said it fixed the vulnerability right after discovering it. Affected borrowers were offered two years of free credit monitoring, credit reports and identity theft insurance of up to $1 million. Nelnet has not said what the vulnerability was.

If you had a loan with EdFinancial or OSLA in 2022, look for a notice letter and use the monitoring offer in it.

What to do if you were in it

  1. 1

    Freeze your credit at all three bureaus

    A credit freeze is free and stops anyone from opening new credit in your name. Set it up with Equifax, Experian and TransUnion. The FTC explains how: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts

  2. 2

    Watch your statements and credit reports

    Check your accounts for charges you don't recognize and pull your free reports at annualcreditreport.com. If something is wrong, report it at identitytheft.gov and follow the recovery plan it gives you.

  3. 3

    Use the credit monitoring if you were offered it

    If your notice letter includes free credit monitoring, sign up using the instructions in the letter, not a link someone sent you.

  4. 4

    Expect phishing that mentions the breach

    Scammers use real breach news to sound legitimate. Don't click links or call numbers in unexpected texts, emails or calls. Go to the company's own site or the number on your card or statement. Report scams at reportfraud.ftc.gov.

  5. 5

    Check whether your email or phone is in this and other breaches

    Run a free Serus scan. It checks breach databases and the dark web for your email, phone and other details, and Serus keeps watching and alerts you if something new turns up.

Official filings

Timeline

  1. The breach happened

  2. The company made it public

  3. Reported to the Washington Attorney General

Frequently asked

Was I affected by the Nelnet Servicing breach?

It affected borrowers whose loans were serviced for EdFinancial and OSLA. About 2.5 million people were notified. Check for a letter or contact your loan servicer.

What was exposed in the Nelnet breach?

Names, addresses, email addresses, phone numbers and Social Security numbers. Nelnet said financial account and payment information was not affected.

Should I freeze my credit after the Nelnet breach?

Yes, because Social Security numbers were exposed. The FTC says a credit freeze is free and blocks new accounts in your name.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Related guides

All guides
How to make your number private when you call fcc.gov How to stop spam emails consumer.ftc.gov How to opt out of prescreened credit card offers (OptOutPrescreen) optoutprescreen.com How to stop junk mail dmachoice.org

Related articles

All articles

What Happens If Your Email Is on the Dark Web – And What to Do Next

How to Get My Information Off the Dark Web

What Can Someone Do with Your Phone Number?

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.