Company and federal officials said they believed last week's theft of identity data on 3.3 million people with student loans was the largest-ever breach of such information and could affect as many as 5% of all federal student-loan borrowers.
Names, addresses, Social Security numbers and other personal data on borrowers were stolen from the St. Paul, Minn., headquarters of Educational Credit Management Corp., a nonprofit guarantor of federal student loans, during the weekend of March 20-21, according to the company.
ECMC said the stolen information was on a portable media device. "It was simple, old-fashioned theft," said ECMC spokesman Paul Kelash. "It was not a hacker incident."
Citing state and federal criminal investigations, ECMC has released only limited information about the theft since posting a notice on its Web site Friday. It plans to notify affected customers in writing this week.
David Hawn, ECMC's chief business-development officer, said the company didn't believe the data theft was connected with last week's enactment of the largest overhaul of federal student-loan rules in decades. Details are being worked out on how the new law will be implemented, and ECMC said it was still evaluating how the legislation would affect it.
The ECMC incident is the latest in a series of thefts of consumers' financial data in recent years. Earlier this month, a former employee of HSBC Holdings PLC allegedly stole data on about 24,000 Swiss private-bank accounts. In 2005, 40 million accounts serviced by payment processor CardSystems were compromised. In 2007, TJX Co., the company that owns retailer T.J. Maxx, disclosed that 45 million credit- and debit-card account numbers had been breached.
All told, more than 347 million records containing sensitive information have been compromised in the U.S. since 2005, according to the Privacy Rights Clearinghouse, a nonprofit consumer group.
The student-loan market has battled data losses before. In 2006, 1.7 million computer records held by Texas Guaranteed Student Loan Corp. were breached, while the U.S. Department of Education said a bug in its Web site compromised data on 21,000 people.
ECMC's St. Paul headquarters has card-key access for the 320 employees who work there, Mr. Hawn said. He said the company was reviewing its security.
ECMC services and insures more than $11 billion in student loans for the U.S. Department of Education. ECMC also owns Premiere Credit LLC, a federal student-loan collection agency. No Premiere accounts were affected by the theft, Mr. Hawn said.
Federal student-loan guarantors such as ECMC, USA Funds and American Student Assistance have contracts with the federal government to insure student loans against default. Some guarantors also originate student loans, although ECMC does not.
ECMC is the designated guarantor for loans in Oregon, Virginia and Connecticut, but borrowers from all states could be affected.
The 3.3 million social security numbers that were stolen from ECMC represent 8.9 million loans, Mr. Kelash said. One borrower may take out multiple loans.
"We are working with ECMC to make sure that affected individuals are provided with resources to protect their information and to provide with them with identity-theft insurance," said U.S. Department of Education spokesman Justin Hamilton.
Write to Mary Pilon at
marypilon@wsj.com
.bmp)
.bmp)
