Navient Says Ransomware Attack at Partner Law Firm Exposed Customer Data
Summary
Navient says a ransomware attack on a partner law firm's systems exposed customer data, including names, birth dates, addresses and Social Security numbers. The company reports no evidence of access to its own systems or service disruption.
Key points
- Navient says it learned on June 8 that a ransomware attack had affected part of a partner law firm's information systems.
- The law firm told Navient that an unauthorized actor accessed Navient-related data it held while providing legal services.
- The exposed information included borrowers' names, birth dates, addresses and Social Security numbers.
- Navient said it found no evidence of unauthorized access to its own systems and reported no operational or customer-service disruption.
- The company said it began an investigation with external cybersecurity experts and is notifying affected individuals and regulators; it also reported the incident to law enforcement.
Article Details
- Victim Organization
- Navient; an unnamed law firm whose systems were affected
- Incident Type
- Ransomware attack affecting part of the law firm's information systems; an unauthorized actor accessed Navient-related customer data held by the firm.
- Data Types Exposed
- Borrowers' names
- Dates of birth
- Addresses
- Social Security numbers (SSNs)
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- The incident was limited to the law firm's systems. Navient reported no evidence of unauthorized access to its own systems and no operational or customer-service disruption.
- Ransom Or Extortion
- A ransomware attack was reported; ransom demands or other extortion details were not disclosed.
- Claim Status
- confirmed