Consumer complaint received 2025-10-02 00:00:00
Product: Credit reporting or other personal consumer reports — Credit reporting
Issue: Improper use of your report — Reporting company used your report improperly
Company: MOHELA
State: MO

Complaint narrative:
Subject : Formal Complaint of Data Breach, Violation of Consumer Protection Laws, and Irresponsible Handling of Personal Information by MOHELA, XXXX, XXXX XXXXXXXX XXXX Department of Government Efficiency ( DOGE ), XXXX  XXXX, and XXXX  Dear Consumer Financial Protection Bureau Complaint Intake Officer : I am writing to file a formal complaint against XXXX  XXXX XXXX XXXX XXXX ( MOHELA ), XXXX, XXXX XXXX XXXX  Department of Government Efficiency ( DOGE ), XXXX  XXXX, and XXXX  for their collective failure to safeguard my sensitive personal and financial information, resulting in a catastrophic data breach that has exposed my data to the dark web. This breach has caused irreparable harm to my financial security, including the necessity to freeze my personal credit to prevent identity theft and fraud. As a consumer entitled to robust protections under federal law, I demand immediate investigation, enforcement action, and appropriate remedies to hold these entities accountable for their negligence and violations of statute. I am prepared to provide supporting documentation, including the breach notification from XXXX  confirming the exposure of my information on the dark web, credit freeze confirmations, and any additional evidence upon request. 
Factual Background On XX/XX/XXXX, I received an email notification from XXXX, one of the major credit reporting agencies, alerting me that my personal identifiable information ( PII ) including but not limited to my full name, Social Security number, date of birth, financial account details, and student loan recordshad been compromised and was actively being traded on the dark web. This exposure stems directly from a data breach attributable to the interconnected systems and data-sharing practices among MOHELA and XXXX ( as student loan servicers ), XXXX XXXX XXXX DOGE ( as the entity overseeing efficiency cuts in federal agencies, including unauthorized access to Department of Education data systems ) , XXXX XXXX  ( as a financial institution handling related accounts ), and Experian ( as the credit reporting entity that failed to detect and mitigate the vulnerability ). 
These entities bear direct responsibility for the breach due to inadequate cybersecurity measures, insufficient data encryption, and lax oversight in handling consumer data shared across their platforms. In particular, XXXX 's aggressive data access and extraction efforts, led by XXXX XXXX, have exacerbated vulnerabilities in federal systems by prioritizing rapid " efficiency '' reviews over privacy safeguards, leading to the mishandling and unauthorized dissemination of sensitive consumer records. As a result of this irresponsibility, I have suffered immediate and ongoing harm : my personal credit reports have been frozen across all major bureaus to avert fraudulent activity, disrupting my ability to access credit, apply for loans, or engage in routine financial transactions. This has imposed undue financial and emotional burdens, including lost opportunities and the costs associated with credit monitoring services I have since procured at my own expense. 
Violations of Federal Consumer Protection Laws The actions ( or inactions ) of the named entities constitute clear and egregious violations of multiple federal statutes designed to protect consumers from precisely this type of harm. I assert the following breaches, each warranting CFPB intervention : XXXX. Fair Credit Reporting Act ( FCRA ), 15 U.S.C. 1681 et seq. : Under FCRA, credit reporting agencies like Experian and financial institutions like XXXX XXXX are required to maintain reasonable procedures to ensure the confidentiality, accuracy, and security of consumer information ( 15 U.S.C. 1681e ). The breach demonstrates a failure to implement such safeguards, resulting in the unauthorized disclosure of my credit information. Additionally, FCRA mandates timely notification of breaches and free credit monitoring for affected consumers ( 15 U.S.C. 1681c-1 and 1681c-2 ), which was inadequately provided. This violation has directly impaired my right to accurate and secure credit reporting, entitling me to damages, injunctive relief, and attorney 's fees.

2. Fair and Accurate Credit Transactions Act ( FACTA ), Pub. L. No. 108-159 ( 2003 ) : As an amendment to FCRA, FACTA imposes affirmative duties on furnishers of information ( e.g., MOHELA, XXXX, DOGE, and XXXX  XXXX ) and users ( e.g., XXXX  ) to prevent identity theft through the " Red Flags Rule '' ( 16 C.F.R. Part 681 ). The entities ' failure to detect and respond to red flagssuch as unusual data access patterns leading to the dark web exposureviolates these requirements. FACTA further guarantees my right to place a free security freeze on my credit file ( 15 U.S.C. 1681c-1 ), a measure I was forced to invoke reactively due to their negligence.

3. Gramm-Leach-Bliley Act ( GLBA ), 15 U.S.C. 6801 et seq. : GLBA requires financial institutions, including XXXX  XXXX, MOHELA, XXXX, and XXXX, to protect against unauthorized access to or use of customer information through comprehensive information security programs ( 15 U.S.C. 6801 ( b ) ). The breach evidences a systemic failure to develop, implement, and maintain such programs, including risk assessments and employee training. This statute safeguards my fundamental right to privacy in financial dealings, and its violation demands regulatory penalties and restitution.

4. Privacy Act of 1974, 5 U.S.C. 552a : DOGE, under XXXX XXXX 's leadership, has violated this foundational consumer privacy law by granting itself sweeping, unauthorized access to federal databases containing Americans ' sensitive personal information, including education and financial records held by the Department of Education. The Act prohibits federal agencies from disclosing records without consent and mandates safeguards against breaches ( 5 U.S.C. 552a ( b ) and ( e ) ( 10 ) ). DOGE 's data extraction practices, which have been subject to ongoing lawsuits and whistleblower reports for endangering consumer privacy, directly contributed to the breach of my PII. This infringement on my right to control and protect personal data in government records has amplified the harm from the exposure, entitling me to civil remedies and injunctive relief to halt further abuses.

5. Family Educational Rights and Privacy Act ( FERPA ), 20 U.S.C. 1232g ; 34 C.F.R. Part 99 : As my student loan recordsmaintained by MOHELA, XXXX, DOGE ( through its interference in DOE systems ), and the DOEconstitute " education records '' under FERPA, these entities were obligated to protect their confidentiality and prevent unauthorized disclosure. The breach impermissibly exposed this protected information, violating my rights as a student consumer to control access to educational data. FERPA enforcement by the Department of Education must be coordinated with CFPB oversight to ensure comprehensive accountability.

These violations collectively infringe upon my consumer rights under the aforementioned laws, including the right to secure handling of personal data, prompt breach notification, free credit monitoring and freezes, and remedies for resulting harm. The entities ' irresponsibilitynotably DOGE 's cavalier approach to federal data under XXXX XXXX 's directionnot only contravenes statutory mandates but also undermines public trust in the financial and educational systems they operate.

Company public response: Company can't verify or dispute the facts in the complaint
Company response to consumer: Closed with explanation