Navient reports borrower data exposed in a ransomware attack on an outside law firm

Navient, the student loan servicer and lender, disclosed on July 2, 2026 that a ransomware attack on a third-party law firm had exposed borrower information the firm held for Navient. The company learned of the incident on June 8 and determined it material on June 29.

What Navient reported

The data involved was sensitive. Navient said the incident was confined to the firm's environment, with no evidence of access to its own systems and no disruption to operations or customer service.

The materiality call rested on the data rather than any business disruption. Navient did not expect a material effect on its finances and was notifying affected individuals and regulators.

Not stated

The filing does not name the law firm or give the number of borrowers affected.