Dear Student Loans Company Limited,

How many instances were reported of students not receiving their loans into their accounts in the years 2018-2019 and 2019? (Please exclude incidents where students have not provided correct details, the university has not confirmed attendance or the course date not started. For this, please also include suspected phishing calls.)

How many suspected cases were there in the same years of fraudulent payments by the Student Loans Company (This refers to how many students did not received their loans as a result of fraudulent activity i.e. they were hacked/phished and the loans redirected.)

What percentage of these in 2018-2019 and 2019 were due to cybercriminals stealing or redirecting student loans to their own accounts (via phishing or any other form of cyber attack)?

Yours faithfully,

Kelly Friend

SLC FOI Requests - Do Not Reply, Y Cwmni Benthyciadau i Fyfyrwyr

This is an automated response to let you know that your email has been
received by the Student Loans Company Limited ("SLC").

SLC's Freedom of Information Office is only able to deal with requests for
information under the Freedom of Information Act 2000 ("FOIA"). If your
email relates to a request for information under the FOIA, a separate
acknowledgement will be issued with a request reference.

If your email is in relation to a student finance application or account
enquiry, and you have provided sufficient details to identify your account,

your email will be passed to the relevant department. Alternatively,
please contact us using the contact details available at
https://www.slc.co.uk/contact.aspx.

If your email is not a customer enquiry then it has been passed to the
relevant department.

SLC's Freedom of Information Office is unable to advise response timescales

for other departments.

dangos adrannau a ddyfynnir

FOI Requests, Y Cwmni Benthyciadau i Fyfyrwyr

Dear Ms Friend

Thank you for your email dated 03/09/2019.

Your request is being considered under the terms of the Freedom of
Information Act 2000 (“FOIA”).

Your request has been allocated reference number 167-19.

We will respond to you under the terms of the FOIA and within 20 working
days.

We will contact you further for clarification of your request if this is
considered necessary.

Yours sincerely

Ray Gribben| Solicitor
Student Loans Company
100 Bothwell Street, Glasgow G2 7JD
ext: 33841 direct dial: 0141 243 3841

From: Kelly Friend <[FOI #601263 email]>
To: FOI requests at SLC <[SLC request email]>
Date: 03/09/2019 15:26
Subject: Freedom of Information request - Student loans and phishing
attacks

Dear Student Loans Company Limited,

How many instances were reported of students not receiving their loans into
their accounts in the years 2018-2019 and 2019? (Please exclude incidents
where students have not provided correct details, the university has not
confirmed attendance or the course date not started. For this, please also
include suspected phishing calls.)

How many suspected cases were there in the same years of fraudulent
payments by the Student Loans Company (This refers to how many students did
not received their loans as a result of fraudulent activity i.e. they were
hacked/phished and the loans redirected.)

What percentage of these in 2018-2019 and 2019 were due to cybercriminals
stealing or redirecting student loans to their own accounts (via phishing
or any other form of cyber attack)?

Yours faithfully,

Kelly Friend

-------------------------------------------------------------------

Please use this email address for all replies to this request:
[FOI #601263 email]

Is [SLC request email] the wrong address for Freedom of Information
requests to Student Loans Company Limited? If so, please contact us using
this form:
https://www.whatdotheyknow.com/change_re...

Disclaimer: This message and any reply that you make will be published on
the internet. Our privacy and copyright policies:
https://www.whatdotheyknow.com/help/offi...

For more detailed guidance on safely disclosing information, read the
latest advice from the ICO:
https://www.whatdotheyknow.com/help/ico-...

Please note that in some cases publication of requests and responses will
be delayed.

If you find this service useful as an FOI officer, please ask your web
manager to link to us from your organisation's FOI page.

dangos adrannau a ddyfynnir

FOI Requests, Y Cwmni Benthyciadau i Fyfyrwyr

Dear Ms Friend

I refer to your recent email dated 03/09/2019 requesting the following
information under the Freedom of Information Act 2000 (“FOIA”):

“How many instances were reported of students not receiving their loans
into their accounts in the years 2018-2019 and 2019? (Please exclude
incidents where students have not provided correct details, the university
has not confirmed attendance or the course date not started. For this,
please also include suspected phishing calls.)

How many suspected cases were there in the same years of fraudulent
payments by the Student Loans Company (This refers to how many students
did not received their loans as a result of fraudulent activity i.e. they
were hacked/phished and the loans redirected.)

What percentage of these in 2018-2019 and 2019 were due to cybercriminals
stealing or redirecting student loans to their own accounts (via phishing
or any other form of cyber attack)?”

Response

Question 1
We have reviewed your request and in consultation with the appropriate
departments within the Student Loans Company Limited I have concluded that
this information is held, however cannot be released as the cost of
complying with your request would exceed the appropriate limit set out in
the Freedom of Information and Data Protection (Appropriate Limit and
Fees) Regulations 2004.  The limit applying to SLC is £450 or 2.5 days
(calculated to be 18 hours of staff time at £25 per hour).

The information is therefore exempt under section 12(1) of the FOIA and in
accordance with section 17(1) of the FOIA this letter constitutes a
Refusal Notice in respect of your request.

Students not receiving their loans could be advised via letter, email or
telephone, and there is no management information captured at for such
cases, other than phishing.  To search for and collate the information for
cases other than phishing would require the manual analysis of individual
accounts, which would exceed 18 hours of staff time.

By way of advice and assistance, we can answer questions 2 and 3, with the
numbers falling within question 2 being a partial answer to this question,
but only for phishing cases where students have not received their loans
as a result of funds being successfully redirected.

Question 2
The data available relates to academic years (“AYs”) 2017/18 and 2018/19 –
we trust this suffices:

AY 2017/18 – 17
AY 2018/19 – 32

Question 3
We can confirm that all 49 of the students had their funding redirected.
 We do not hold details as whether these were cyber criminals or other
third parties.

Internal review process

If you are dissatisfied with the handling of your request, you have the
right to ask for an internal review.

Internal review requests should be submitted within two months of the date
of receipt of the response to your original request and should be
addressed to the Freedom of Information Office, Student Loans Company
Limited, 100 Bothwell Street, Glasgow, G2 7JD,  or by email:
[SLC request email].  Please remember to quote the reference number
above in any future communications.

If you are not content with the outcome of the internal review, you have
the right to apply directly to the Information Commissioner for a
decision.  The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House  
Water Lane  
Wilmslow  
Cheshire  
SK9 5AF

Yours sincerely

Louise Chapman | Senior Legal Executive
Student Loans Company
100 Bothwell Street, Glasgow G2 7JD
e: 32080  t: 0141 306 2080

[1]www.gov.uk/slc
Follow us at [2]Twitter/SLCcomms for the latest corporate news and updates

dangos adrannau a ddyfynnir

References

Visible links
1. http://www.gov.uk/slc
2. file:///tmp/www.Twitter.com/SLCcomms