Student loan company tells 16,500 borrowers of data breach

A student loan services company recently notified 16,500 borrowers that files containing personal data were released to a business that wasn't authorized to receive them.

Access Group Education Lending said in a letter to those affected that the data breach happened on March 23 when one of its vendors sent out files — including borrowers' names, driver's license numbers and Social Security numbers — to another business. The business was not identified, but has been described as a student loan lender.

Access Group said in the letter that it learned of the release on March 28 and it was assured that the vendor who received the files deleted them and didn't retain copies. The company did not begin notifying borrowers until three weeks later.

In response to questions from The Associated Press, Access Group said in a statement that exposure to personal information was limited and has been terminated. Those who were affected are being offered free credit monitoring services for a year.

"Access Group values the trust our student loan borrowers and co-signers have placed in us, and we hold the privacy of our customer's personal information in the highest regard," the company said. "We regret any concern this incident may have caused our borrowers and we feel confident that we have minimized any threat to their personal information."

Access Group said the information was inadvertently released by Nelnet, which processes student loans for Access Group. To prevent something similar in the future, Access Group will continue to monitor its vendors and require written data transfer protocols.

Nelnet spokesman Ben Kiser said in a statement that security of customer information is of the upmost importance and the company regrets that a file was inadvertently sent to the wrong student loan lender, which he described as a trusted business partner.

"Nelnet has no reason to believe the information has been used inappropriately. The data file was sent through an encrypted channel," he said, adding that the lender that got the information recognized the mistake and destroyed the data.

According to information on its website, Access Group stopped making loans in 2010, due to legislation that eliminated the federally guaranteed student loan program.

Access Group Education Lending is the servicing, loan portfolio management and default division of AccessLex Institute. AccessLex Institute is a nonprofit company, based in West Chester, Pennsylvania, that focuses on serving law students. The company works to make legal education accessible to people from all backgrounds and has programs to help law students manage their personal finances, its website says.

__

Associated Press writer Andrew Welsh-Huggins contributed to this report from Columbus, Ohio