$10M Nelnet Settlement Resolves Class Action Lawsuit Over June 2022 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Nelnet Servicing, Edfinancial and the Oklahoma Student Loan Authority (OSLA) have agreed to a $10,000,000 settlement to resolve class action litigation alleging that the student loan servicers failed to implement proper cybersecurity measures to safeguard sensitive student loan information, leading to a June 2022 data breach.

Don’t miss out on class action settlement news like this. Sign up for ClassAction.org’s free weekly newsletter.

The Nelnet class action settlement received amended preliminary approval on December 4, 2025 and covers all individuals in the United States whose personal information may have been compromised in the June 2022 Nelnet data breach. Per court documents, approximately 2,501,324 student borrowers of OSLA and Edfinancial, to whom Nelnet provided technology services, will be covered by the settlement.

The court-approved website for the Nelnet Servicing data breach settlement can be found at NelnetSettlement.com.

Related Reading: Nelnet Lawsuit Claims Student Loan Servicer Grossly Miscalculated Monthly Repayment Amounts

According to the website, Nelnet settlement class members who submit a valid, timely claim form have multiple options for reimbursement.

Those who submit with their claim form documented proof of out-of-pocket losses from the data breach are eligible to receive a one-time cash payment of up to $5,000, the settlement site relays. These covered losses, the agreement explains, must have been incurred as a result of the data breach, and reimbursable expenses include, but are not limited to, those related to identity theft, fraud, credit monitoring and other professional services.

Furthermore, class members may also submit a claim for up to four hours of lost time spent remedying issues related to the data breach at a rate of $25 per hour, which the settlement agreement reports is subject to the same $5,000 total loss-reimbursement cap.

In lieu of a documented loss or lost time payment, Nelnet settlement class members may instead file a claim to receive a one-time, pro-rated cash payment from what remains in the net settlement fund after the payment of attorneys’ fees, settlement administration costs, lead plaintiff service awards and the cost of all other benefits. The agreement reports that class members who resided in California at the time of the data breach will receive a two-times multiplier on their pro-rated cash payment due to state-specific laws.

Nelnet settlement class members may elect to receive their cash payout via check or electronic payment services, the agreement imparts, and all checks must be cashed within 60 days of issuance.

In addition to either cash payout option, all class members may also file a claim to enroll in two free years of credit monitoring and identity theft protection, activation codes for which will be issued via email, according to settlement documents.

To submit a Nelnet settlement claim form online, class members can head to this page and enter the unique ID and PIN provided on their copy of the settlement notice. Alternatively, class members can download a PDF of the claim form from the settlement site to print, fill out, and return by mail to the address of the settlement administrator listed on the first page.

Consumers who believe they may be a Nelnet settlement class member but did not receive a notice may file a blank claim form.

All Nelnet data breach claim forms must be submitted online or by mail by March 5, 2026.

The court will determine whether to grant final approval to the Nelnet data breach settlement at a hearing on May 5, 2026. Compensation will begin to be distributed to class members only after final approval is granted and any appeals are resolved.

The Nelnet data breach class action lawsuits, which were consolidated in January 2023, alleged that the student loan servicer (as well as Edfinancial and OSLA, which received technology services from Nelnet) did not implement necessary security measures to safeguard the personal information stored on its systems, which allowed an unauthorized party to access the data of over 2.5 million student loan borrowers of Edfinancial Services and the Oklahoma Student Loan Authority. Per court documents, the student information potentially compromised as a result of the data breach included loan account information such as names, addresses, contact information and Social Security numbers. 

Check out ClassAction.org’s lawsuit list for current class action lawsuits.