The theft of one laptop computer has resulted in compromising the personal information of more than 5,000 student loan customers.
American Education Services -- the revenue-generating arm of the Pennsylvania Higher Education Assistance Agency -- has sent letters to 5,184 student loan customers telling them that their personal information was on a laptop stolen in a burglary at a subcontractor's headquarters in Livermore, Calif.
The subcontractor is Vista Financial Inc., a subsidiary of Performant Financial Corp.
The information, which was not encrypted, included name, address, phone number, e-mail address and Social Security number.
Most of the affected customers likely are in Pennsylvania, but AES does business across the country.
Keith New, spokesman for AES and PHEAA, said the Vista employee violated the security policies of Vista and AES in the use of the laptop.
In the customer letter, AES offers a year of free credit reporting service and recommends a fraud alert be placed with the credit bureaus.
"We are deeply sorry for the concern this may cause you, but we assure you that we take our responsibility to protect the privacy and security of our customers' information very seriously," Jody L.W. Angelini, vice president, enterprise security office, wrote the customers.
Mr. New said that Vista was hired to counsel Stafford loan recipients about their loan consolidation options. He said some customers don't realize they will lose some of the loan benefits -- such as reduced rates for good repayment histories -- offered by AES if they switch to another outfit for consolidation.
In cases where AES customers do choose another consolidator, Vista will call during the 10-day waiting period to alert them to savings they may have with AES.
"We're trying to protect our borrower from losing the benefits they already have that we provide as a nonprofit in Pennsylvania," Mr. New said.
About its services in general, Vista's Web site states, "In the last three years, third-party consolidators have captured more than $25 billion in loans from portfolios lacking adequate defenses.
"Aggregate costs to holders of loans that are consolidated away by third parties are in the hundreds of millions of dollars per year. These costs can be avoided."
Vista could not be reached for comment.
Mr. New said police believe the laptop was stolen in a random break-in, not a deliberate effort to steal identities, but he said, "Anytime information gets out, you have to be concerned about it."
The police report was filed on July 17. Mr. New said the letter went out on July 20, shortly after AES was notified.
Mr. New said AES will do a "physical security audit" of Vista's operations to make sure they comply with stringent security standards.