The main Nelnet lawsuit is a consolidated class action over a 2022 data breach that exposed personal information belonging to roughly 2.5 million student loan borrowers. On May 21, 2026, a federal judge in Nebraska granted final approval to a $10 million settlement, dismissed the case with prejudice, and cleared the way for payments to more than 308,000 verified claimants.
What the 2022 Breach Exposed
Between early June and late July 2022, unauthorized actors exploited a vulnerability in a website used by certain student loan servicers to access borrower account information. Nelnet identified the issue and began notifying affected servicers on July 21, 2022. A forensic investigation confirmed on August 17, 2022, that personal data had been accessed without authorization. Nelnet publicly disclosed the breach on August 26, 2022.
Names, addresses, email addresses, phone numbers, and Social Security numbers were compromised. Financial account numbers and payment information were not. The affected borrowers were not Nelnet’s own direct customers. Their accounts belonged to two entities that used Nelnet’s servicing platform: Edfinancial Services, a private company in Knoxville, Tennessee, and the Oklahoma Student Loan Authority (OSLA), a public trust. An OSLA attorney said roughly 250,000 of the affected borrowers were in OSLA’s portfolio. Nelnet offered impacted borrowers 24 months of free credit monitoring and identity theft protection through Experian.
What the Class Action Alleged
Multiple lawsuits filed in the months after the disclosure were consolidated in the U.S. District Court for the District of Nebraska as In re Data Security Cases Against Nelnet Servicing, LLC, before U.S. District Judge John M. Gerrard.
Plaintiffs alleged Nelnet failed to take reasonable steps to protect borrower information and pointed to what they called negligent and inadequate security. A central complaint was the delay in notifying borrowers: Nelnet discovered unauthorized access on July 21, 2022, but did not notify state attorneys general until around August 26, 2022, and plaintiffs said the company offered no adequate explanation for the gap.
The legal claims included negligence, breach of implied contract, unjust enrichment, invasion of privacy, violations of the California Consumer Privacy Act, and violations of various state consumer protection statutes. Plaintiffs sought damages and injunctive relief. Nelnet and the settling entities denied violating any law and disputed the allegations throughout the case.
What the $10 Million Settlement Pays
Judge Gerrard granted preliminary approval on March 31, 2025, and issued an amended preliminary approval order on December 4, 2025. The settlement class covers all people in the United States whose personal information was compromised in the breach announced on August 26, 2022.
Class members who filed valid claims by the March 5, 2026 deadline could choose among four forms of relief:
- Reimbursement of up to $5,000 for documented out-of-pocket losses tied to the breach, such as fraud losses, credit freezes, and related costs.
- Up to four hours of lost time at $25 per hour for dealing with the breach, subject to the same $5,000 total cap.
- A pro-rated cash payment from whatever remained in the fund after costs and fees, for class members not claiming specific losses. Borrowers who were California residents at the time of the breach receive a two-times multiplier on this amount.
- Two years of free credit monitoring and identity theft protection.
From the $10 million fund, the court approved $3,333,333.33 in attorneys’ fees, $65,000 in litigation costs, and $1,500 service awards for each named class representative. A.B. Data, Ltd. serves as claims administrator.
Where the Settlement Stands
The fairness hearing was held on May 5, 2026. No class members objected. On May 21, 2026, Judge Gerrard entered final judgment, ruling the agreement “fair, reasonable, and adequate” under Federal Rule of Civil Procedure 23(e)(2) and dismissing the case with prejudice. More than 308,000 claims were verified as eligible.
The exact per-person payout has not been publicly disclosed. The settlement website noted the amount depends on the mix of relief options selected and the total number of approved claims, and that any appeals could delay payments by a year or more.
Claim processing is ongoing, including deficiency notices sent to claimants whose submissions were incomplete. Those who received a deficiency notice can cure their claims through the portal at NelnetSettlement.com or by calling 1-877-388-1763.
Other Nelnet Lawsuits and Enforcement
The data breach case is the largest recent Nelnet lawsuit, but it is not the only legal action against the company. Separate litigation and one state enforcement action focus on how Nelnet has handled income-driven repayment (IDR) plans.
Income-Driven Repayment Class Actions
In June 2018, a class action complaint (Olsen v. Nelnet, Inc., Case No. 4:18-cv-03081) was filed in the District of Nebraska alleging that Nelnet improperly processed and delayed IDR applications, placed borrowers in unnecessary forbearance or deferment, and caused them to accrue capitalized interest and extended repayment timelines. The complaint said these practices maximized Nelnet’s servicing fees at borrowers’ expense.
A related class action (Johansson et al v. Nelnet, Inc., Case No. 4:20-cv-03069) was filed in June 2020, raising similar allegations about IDR renewal delays and interest capitalization. In May 2022, Magistrate Judge Cheryl R. Zwart denied the plaintiffs’ motion to amend their complaint, finding they had not been diligent in meeting the court’s deadline. That case remained active in the District of Nebraska as of the available record.
Massachusetts Attorney General Settlement
On January 11, 2024, the Massachusetts Attorney General’s Office announced a $1.8 million settlement with Nelnet resolving an investigation into how the company communicated with borrowers enrolled in IDR plans between 2013 and 2017. The investigation found that Nelnet sent faulty or missing recertification notices, failed to give borrowers the required 60 days’ notice of upcoming deadlines, and failed to explain the consequences of missing recertification, such as payment increases and capitalized interest. The AG’s office said these failures violated the state’s consumer protection law.
Under that settlement, $1 million went to the Commonwealth’s General Fund and $800,000 to the Student Loan Trust Fund. Nelnet was also required to comply with federal IDR notice requirements for Massachusetts borrowers going forward and to retain copies of related communications for three years.