INDIANAPOLIS - A college savings program that's supposed to give parents a peace of mind is instead causing headaches and worry after families learn their social security numbers and other personal information were breached.
Now, state contractors are on alert.
Outside one of the nation's largest student loan servicing centers is a warning: someone's watching. But it's the inside job David Miller is concerned about. He just learned the 529 College Savings accounts for his 16-year-old son Zach and 13-year-old son Noah were breached.
The suspect is an employee at another Sallie Mae spin-off in Massachusetts - College Choice.
"To sit there thinking someone has all my personal information and you have no idea how long, down the road, they could sell it to somebody. They could be taking out loans with my kids social security numbers. It's very scary," Miller said.
In a letter sent to more than 300 parents, College Choice admitted an employee with its program manager, UPromise Investments, accessed names, social security numbers, birthdays and other contact information for seven months while on the job.
"We have details, controls in place and were suspicious of something and immediately acted upon them," said UPromise spokesperson Debbie Hohler in a phone interview. "And placed withdraw holds on all potentially affected accounts."
That's important, because the employee was in charge of withdrawals and deposits.
"There is no indication that he attempted to act to withdraw money from any of the accounts in the Indiana plan," Hohler said. "He couldn't print, he couldn't email."
But, she said, the employee could write information down.
Miller says he can't feel assured by that news.
He began socking away money for his sons four years ago as the state touted its 529 College Savings plan. Signing up was supposed to bring peace of mind for the future, not worry over the account or his sons' credit.
"I called the state to let them know how unhappy I was," Miller said. "They did say they were aware of the situation, that they had been contacted by College Choice, but basically, we were on our own."
Parents once left alone are now under security watch. They are forced to mail letters, birth certificates and other personal information to prevent a savings plan from costing their kids a price they shouldn't have to pay.
College Choice is providing two years of credit monitoring for the 300-plus families. The state treasurer's office would not talk about the breach on camera, but provided this statement:
"The Indiana Education Savings Authority was notified promptly. We are satisfied that UPromise has taken all the necessary steps to both address the problem and to protect the identity of the affected account holders."
