Navient

Disclosed Jul 2, 2026Confirmed

Navient borrower SSNs exposed in ransomware attack on outside law firm

Student loan servicer Navient told the SEC that a ransomware attack on a third-party law firm exposed borrower names, birth dates, addresses and SSNs held by the firm. Navient's own systems were not compromised.

What is known

People affected	Not stated in the sources we have
Disclosed	Jul 2, 2026
Discovered	Jun 8, 2026
Attack	Vendor breach
Data exposed	NamesDates of birthAddressesSocial Security numbers
Sector	Finance · US
Status	Confirmed

Sources

SEC filingsec.gov

Navient Corp Form 8-K, Item 1.05 (2026-07-02)

Notices filed

TotalJul 2

SEC 8-KCount not stated

TotalJul 2

ResearchCount not stated

History of this record

sector2026-09-25

other to financeby seedSource

attack2026-09-25

unknown to third-partyby seedSource

data_types2026-09-25

[] to ["names","dob","addresses","ssn"]by seedSource

discovered2026-09-25

empty to 2026-06-08by seedSource

summary2026-09-25

empty to Student loan servicer Navient told the SEC that a ransomware attack on a third-party law firm exposed borrower names, birth dates, addresses and SSNs held by the firm. Navient's own systems were not compromised.by seedSource

title2026-09-25

Material cybersecurity incident reported to the SEC (8-K Item 1.05) to Navient borrower SSNs exposed in ransomware attack on outside law firmby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (SEC 8-K), confirmed by SEC 8-K. Record counts are as reported. Not legal advice.

Everything about Navient