Educational Credit Management Corp. said the data included names, addresses, Social Security numbers and dates of birth of borrowers, but no financial or bank account information.
The data was on “portable media” that was stolen sometime last weekend, ECMC said in a statement. Company spokesman Paul Kelash wouldn’t specify what was taken, citing the ongoing investigation, but said there were no indications of any misuse of the data.
The St. Paul-based nonprofit said it discovered the theft last Sunday and immediately contacted law enforcement, and made the theft public when it received permission from authorities. The Minnesota Bureau of Criminal Apprehension is leading the investigation.
ECMC said it has arranged with credit protection agency Experian to provide affected borrowers with free credit monitoring and protection services. Borrowers will be receiving letters from ECMC soon on how to sign up, gain access to fraud resolution representatives, and be provided with identity theft insurance coverage.
“We deeply regret that this incident occurred and the stress it has caused our borrowers and our partners and are doing everything we can to help protect our borrowers’ identity and personal information,” Richard Boyle, president and CEO of ECMC, said in the statement.
ECMC is a contractor for the U.S. Department of Education to provide collection and document management services. It guarantees student loans through the Federal Family Education Loan program, and provides support services for student loans that are in default or bankruptcy. The company can act as the guarantor, loan holder or loan servicer.
Department of Education spokesman Justin Hamilton said protecting student privacy is a top priority.
“We are working with ECMC to make sure that affected individuals are provided with resources to protect their information and to provide with them with identity theft insurance,” Hamilton said. said protecting student privacy is a top priority for the agency.
Those who believe they may be affected were encouraged to visit ECMC’s Web site, http://www.ecmc.org, or call 1-877-449-3568 beginning Saturday.
According to the Privacy Rights Clearinghouse, more than 347 million individuals have been affected by data privacy breaches at hundreds of government agencies, universities and businesses since 2005.
Nikolay Fedotov, Chief InfoWatch analyst gives his view of the situation: "Social security number, including the name and the birth date, costs around 16-18 USD per record. Considering bulk discount the malefactor can get 20-30 mln USD for such database. Quite a large sum! I guess one hardly can resist the temptation. When we talk about small companies which process personal data of tens or hundreds of clients the temptation is not so high. But in case of federal information systems containing millions of personal data records it becomes irresistible. Quantity turns into quality. That’s why I’m sure huge companies must implement special technical protection systems, DLP (Data leakage prevention) solutions for instance. Moreover such system will be repaid by the first prevented data leak".
