A major student loan servicing provider says that hackers stole data of millions of borrowers, just as the Biden administration announced plans to cancel some debt. Cheddar News speaks with Pete Nicoletti, Chief Information Security Officer of the Americas at Check Point Software Technologies, about what scammers are after and the tactics they might use. 


Closing Bell

Why Hackers Are Targeting Student Loan Borrowers

Welcome back to closing balance, better news everyone. Well after the biden administration announced plans to cancel some federal student loan debt for millions of americans, hackers wasted little time to seize on the opportunity with major student loan servicing provider mel net, disclosing last week data of over 2.5 million borrowers from the Oklahoma student loan authority and loan servicer Ed Financial was compromised after hackers breached the systems. The announcement also prompting the Better Business Bureau to put out a warning for possible scams as con artists are known to take advantage of any confusion surrounding big government initiatives. So joining me now is Pete Nicoletti, field chief information security officer, um, at the Americas at the software company, Check point Software technologies. Pete thanks so much for coming on the show. So why are hackers targeting student loan borrowers and what exactly are they after? Well, they're after. You know, it's like Willy Sutton said, you know, I robbed banks because that's where the money is. The. Same thing goes with hackers targeting financial information from students. You know, students are getting uh, you know, conflicting information out there and when they get an email that looks uh, to be from somebody legitimate, they may click on that link and start sharing information. So that's when the students really need to turn up their spider senses, make sure they're tingling. If it's too good to be true, it is too good to be true. It used to be, you know, Nigerian princes are going to give you money. It used to be, you know, amazon crime day. There's some kind of new amazon deal that's out there. Same thing goes with package delivery when you didn't order anything. The big thing is turn up your spider senses. Look at that email, don't click on the link, go right to the provider that you're working with. So I want you to walk through how some of these scams actually work pete and and how these hackers are able to make way to actually get money out of this process? Well, the first thing is, they have, they have billions of email addresses on hand. The affiliate groups share uh, these purloined email addresses and passwords from other breaches, including this breach that you mentioned Kristen and they're going to send out messages and they only need a fraction of a percent to work. So they're sending out these messages saying, hey, we can, we can help you process your loan, we can with a small upfront payment, we can make your loan debt go away. If it's too good to be true. It is. So you really have to go right to the source. You have to go to student aid dot gov and you have to protect that credential that you have, you know, the credential that you're using to sign in there is as good as your signature, there's only eight legitimate companies that are processing student loans right now. And if you're dealing with somebody else, it's probably a scammer mhm So that's right, 2.5 million borrowers actually exposed here in this latest scam. If borrowers are compromised, peter they're concerned about being compromised. What are the steps that they should take to make sure that their data going forward at least is safe. Absolutely. A couple of things, you know, nell net is not proud of their hack. You can't really see it on their web page. Hopefully you're getting a letter and you'll join in the class action suit. But the best way to do it in general is don't reuse your name and password. And if you think you've got to have been compromised, go to a website run by a security researcher called have I been phoned P. W. N E D dot com? It will give you pop in your name and your password, uh your name, not your password, your email or your your phone number. And it will show you which breaches you've been exposed at, then make sure you don't you're not reusing that password. So you have to make sure that your that name and password is unique for every business that you work with. Turn on, multi factor authentication, make it pin your phone, make sure you're watching for changes. If somebody changes your your primary gmail account and you don't know about it, that your account is going to be taken over, you're gonna be signing up for things that you don't want to sign up for and you're gonna be paying for things that you didn't you didn't sign up for. I want to pay for. So my final question is let's say you make a mistake. Let's say you accidentally click or open one of these attachments. You are then obviously a target of one of these scams and your data is potentially compromised. What are the next steps? What should you do? We'll change the password immediately change the passwords on that student aid dot gov site because that is as good as the signature. If you've reused your password which I just told you not to do make sure that all the sites that you're using that password are changed because they're selling your information to affiliate groups and literally in minutes they're going to be trying to compromise that name and password combination at various banks at various other places. They're gonna be signing there for gift cards. They're going to be doing all kinds of nonsense and bad things in your name. So don't reuse passwords. Use multi factor authentication using unique passwords and keep your your your your device is up to date, you know and it says updated, do an update knowing that probably was breached because of a vulnerability that they didn't update. I know that's um that's always a painful process. We'll look for these 2.5 million borrowers impacted. We wish them the best and Pete thank you for joining that's Pete. Nicoletti Field Chief information security officer of the Americas at Check Point Software Technologies.