Consumer complaint received 2025-02-12 00:00:00
Product: Student loan — Federal student loan servicing
Issue: Dealing with your lender or servicer — Trouble with how payments are being handled
Company: Servicer under contract with Federal Student Aid
State: NV

Complaint narrative:
I recently discovered that my sensitive and legally protected records were accessed and potentially shared without my consent. Major news media sources report that on XX/XX/XXXX XXXX XXXX and XXXX XXXX, at the behest of XXXX XXXX and the DOGE, gained access to sensitive DOE information. This includes but is not limited to : XXXX. My academic records and personally identifiable information ( PII ). 
XXXX. My Free Application for Federal Student Aid ( FAFSA ) data, including financial aid history and loan information. 
XXXX. My IRS tax transcripts, which were obtained and used without proper authorization. 
This data breach represents departmental negligence, breach of contract, violations of statutory rights, and potential unjust enrichment. The unsanctioned accessing of these records without my consent represents potential alteration to my financial aid package, loan details, and/or servicing history. DOE & DOGE compromised the integrity of the loan process, undermined the legitimacy of loan records, and thus invalidated the loan terms as supported by the following : Breach of FERPA ( Family Educational Rights and Privacy Act of XXXX, XXXX. XXXX XXXX. XXXX, XXXX XXXX. XXXX ( XXXX ) ( codified as amended at 20 U.S.C. 1232g ) which grants me the right to control access to my educational records. FERPA violations, such as unauthorized access or disclosure of a borrower 's educational records ( e.g., loan details, financial aid history ), undermine the integrity of the loan process. 
Failure to Comply with Title XXXX of the HEA ( Higher Education Act of XXXX, Pub. L. No. 89-329, 79 Stat. 1219 ( 1965 ) ) ( codified as amended at 20 U.S.C. 10701099d ) which governs the use and protection of federal student aid information and requires the Department of Education and its contractors to protect borrower information. Violations, such as improper use of FAFSA data or failure to secure borrower records, could undermine the legitimacy of the loan process. 
Violation of the Privacy Act of XXXX ( Privacy Act of XXXX, XXXX. XXXX XXXX. XXXX, XXXX XXXX. XXXX ( XXXX ) ( codified as amended at 5 U.S.C. 552a ) which ensures that federal agencies, including the DOE, handle personal information responsibly. Unauthorized access or misuse of borrower data ( e.g., IRS tax transcripts, Social Security numbers ) constitutes a violation. Failure to protect borrower data which included IRS tax data, compromised loan servicing, exposed borrowers to identity theft, fraud, or other harm, and compromised the ability to repay the loan. 
The Department of Education is required to follow federal cybersecurity standards ( Federal Information Security Management Act of XXXX, Pub. XXXX XXXX. XXXX, XXXX XXXX. XXXX ( XXXX ) ( codified as amended at 44 U.S.C. 35413549 ) to protect borrower data. A data breach that exposes sensitive information could constitute a failure to meet these obligations.

Company response to consumer: Untimely response