Virginia student loan administrator Southwood Financial hit by ransomware attack
Learn More
Southwood Financial, a private student loan administrator based in Sterling, Virginia, has been hit by a ransomware attack that compromised sensitive personal information belonging to borrowers and potentially employees. The cyberattack was claimed to the Akira ransomware group.
The incident began on March 25, 2025, when Southwood Financial detected suspicious activity that disrupted its computer network operations. The company initiated an investigation with external cybersecurity specialists. Southwood Financial confirmed on May 29, 2025, that compromised files contained personal information belonging to borrowers and possibly employees. Exposed data includes:
- Names
- Social Security numbers
- Dates of birth
- Addresses
- Telephone numbers
- Email addresses
- Other account information
The number of affected individuals has not been disclosed.
The company began notifying affected individuals on June 27, 2025, and filed the required data breach disclosure with the Vermont Attorney General's office on June 30, 2025. Southwood is providing affected individuals with credit monitoring services to help protect against potential identity theft and fraud.
The company has established a dedicated helpline at 1-833-367-4551 to assist affected individuals with questions about the incident and the protective services being offered.
