This incident did not affect borrowers serviced by Nelnet and Great Lakes or other Nelnet businesses, systems, or applications

Protecting the personal information customers, clients, and associates entrust to Nelnet is a top priority. Nelnet takes safeguarding data seriously and is committed to continue taking steps to keep information secure. Because of this commitment, Nelnet is providing information about a recent security incident and regrets any inconvenience and concern this may have caused servicing clients and their borrowers.

What happened? On July 21, 2022, Nelnet began notifying impacted student loan servicers that use our servicing system about an isolated incident impacting their website used by borrowers to access account information. Our cybersecurity team discovered a vulnerability believed to have led to this incident and took immediate action to secure the systems, block the suspicious activity, and fix the issue. The Department of Education was also notified, and we launched an investigation with third-party forensic experts to determine the nature and scope of the activity.

On August 17, 2022, the forensics investigation determined that certain student loan account registration information was accessed by an unknown party at times between early June and late July 2022.

Nelnet and the Department of Education have notified law enforcement and are cooperating with the investigation.

Who was affected? The forensics investigation identified approximately 2.5 million impacted borrowers whose student loans are serviced by servicers using the affected websites.
This incident did not affect borrowers serviced by Nelnet and Great Lakes or other Nelnet businesses, systems, or applications.

What information was involved? The forensics investigation determined that the impacted information included borrowers’ name, address, email address, phone number, and Social Security number. This incident did not impact financial account numbers or payment information.

What are we doing? There is no known misuse of information; however, student loan servicers are providing notification to the impacted borrowers, which includes several resources to help protect themselves against any potential consequences of this incident. This includes offering immediate access to credit monitoring and identity theft protection services for 24 months at no cost to affected borrowers.

It is important for everyone, not just impacted borrowers, to remain vigilant against identity theft and fraud by regularly reviewing account statements and monitoring free credit reports for any suspicious activity and to detect errors. Under U.S. law, a consumer is entitled to one free credit report annually from each of the three major credit reporting bureaus, Equifax, Experian, and TransUnion.