What Is the Nelnet Lawsuit?
The Nelnet lawsuit is a federal data breach class action over a 2022 attack on Nelnet's student loan servicing portal. The case is captioned Spearman v. Nelnet Servicing, LLC, No. 4:22-cv-3191, in the U.S. District Court for the District of Nebraska.
The named defendants are Nelnet Servicing, LLC and EdFinancial Services, LLC. The Oklahoma Student Loan Authority (OSLA) joined the settlement as a third settling entity. OSLA is not a named defendant in the Nebraska case.
The class covers about 2.5 million student borrowers whose loans originated with EdFinancial or OSLA. Borrowers whose loans came from other lenders were not part of the class, even when Nelnet serviced those loans.
“This case involves a data security breach that occurred from June to July 2022, when an unauthorized third party accessed the class members' student loan account registration information on systems controlled by one of the defendants, Nelnet Servicing, LLC (the "Data Security Incident"). Approximately 2.5 million student borrowers had loans that originated with either EdFinancial Services, LLC, or the Oklahoma Student Loan Authority.”
Source: U.S. District Court for the District of Nebraska, Spearman v. Nelnet Servicing, LLC, No. 4:22-cv-3191, Memorandum and Order, Doc. 181 (May 21, 2026)
Why Are People Filing Nelnet Lawsuits?
People began filing Nelnet lawsuits in August 2022 because an unauthorized party accessed student loan account information on Nelnet's web portal in mid-2022. The access ran from June to July 22, 2022. Plaintiffs allege Nelnet failed to protect that information.
EdFinancial's notice letter, dated August 26, 2022, says Nelnet told EdFinancial on July 21, 2022 that it had discovered a vulnerability. The letter says Nelnet's investigation found on August 17, 2022 that an unknown party could access the information. The exposed data included names, addresses, email addresses, phone numbers, and Social Security numbers. The letter says financial account numbers and payment information were not affected.
The plaintiffs pleaded negligence, negligence per se, breach of implied contract, unjust enrichment, breach of confidence, and invasion of privacy. They also pleaded state consumer protection claims. The settling entities deny violating any law.
Plaintiffs' preliminary approval motion says confidential discovery was consistent with one individual who did not sell the data for posting to the dark web. That statement describes plaintiffs' own summary of discovery, not a court finding.
What Injuries Are Included in the Nelnet Lawsuit?
The injuries included in the Nelnet lawsuit are financial and privacy harms, not physical injuries. The four categories below follow the claims pleaded and the benefits the settlement offers. The settling entities deny that they caused any of these harms.
Identity Theft and Fraud Risk
Identity theft is the unauthorized use of another person's identifying information, such as a Social Security number, to open accounts or obtain credit.
Plaintiffs allege the exposed Social Security numbers, names, and contact details raised class members' exposure to fraud and identity theft. The settlement responds with two years of credit monitoring and identity restoration for any authorized claimant.
Invasion of Privacy
Invasion of privacy is a legal claim that someone intruded on information a person reasonably expected to keep private.
The complaints plead invasion of privacy and breach of confidence because a third party reached borrowers' registration information. No court decided those claims on the merits, because the case settled.
Out-of-Pocket Losses
Out-of-pocket losses are money a person spends because of a data breach, such as fraudulent charges or credit freeze fees.
The settlement reimbursed losses that were fairly traceable to the breach, including mitigation costs paid after June 10, 2022. It required third-party documentation for these claims.
Lost Time
Lost time is the hours a person spends responding to a data breach, such as checking statements or placing fraud alerts.
Plaintiffs treat time spent on breach response as compensable harm. The settlement allowed a short sworn description of that time instead of receipts.
Who Qualifies for the Nelnet Lawsuit?
You may qualify if:
- You are a person in the United States whose personal information was compromised in the 2022 data security incident
- Your student loan originated with EdFinancial Services, LLC or the Oklahoma Student Loan Authority and used Nelnet's servicing portal
You may not qualify if:
- Nelnet only serviced a loan that another lender originated, because the court said only borrowers matched to EdFinancial or OSLA loans were class members
- You timely and validly excluded yourself from the settlement class
- You are a settling entity, one of its officers or directors, or a judge or family member covered by the class exclusions
- A court found you guilty of causing or aiding the incident
The March 5, 2026 claims deadline has passed, so this summary explains the class definition for reference only. Only the settlement administrator's records can confirm whether a specific person was a class member.
What Is the Current Status of the Nelnet Lawsuit?
The current status of the Nelnet lawsuit is settled and dismissed with prejudice, with final approval granted and the claims window closed. The court keeps jurisdiction over how the settlement is carried out.
Spearman v. Nelnet Servicing, LLC, No. 4:22-cv-3191
Lowey Dannenberg and Silver Golub & Teitell filed Spearman on September 7, 2022. Senior U.S. District Judge John M. Gerrard consolidated 23 putative class actions on January 30, 2023 and appointed both firms interim co-lead class counsel.
The Judicial Panel on Multidistrict Litigation denied a motion to centralize the cases as MDL No. 3053 on December 13, 2022. The litigation therefore proceeded as one consolidated class action in Nebraska, not as an MDL. A parallel Oklahoma suit, Carr, appears in the comparison section below.
| Proceeding Type | Consolidated federal class action (not an MDL; the JPML denied centralization in December 2022) |
| Court | U.S. District Court for the District of Nebraska |
| Judge | Senior U.S. District Judge John M. Gerrard |
| Class Counsel | Lowey Dannenberg, P.C. and Silver Golub & Teitell LLP |
| Defendants | Nelnet Servicing, LLC and EdFinancial Services, LLC (OSLA joined the settlement) |
| Class Size | 2,502,916 individuals |
| Settlement Fund | $10,000,000 (non-reversionary) |
| Settlement Administrator | A.B. Data, Ltd. |
| Settlement Status | Final approval and dismissal with prejudice entered May 21, 2026; claims deadline passed March 5, 2026 |
Did Nelnet Settle the Lawsuit?
Yes. Nelnet Servicing, LLC and EdFinancial Services, LLC settled the Nelnet lawsuit for a $10 million non-reversionary fund. The court granted final approval on May 21, 2026.
Payment timing is not confirmed. The settlement agreement sets payment within 30 days after the later of two events. Those are the Effective Date and the court's review of the distribution declaration. The Effective Date generally follows the end of the appeal period or any appeal. This page could not verify an Effective Date or a payment date as of October 6, 2026.
Authorized claimants could choose two years of credit monitoring with identity restoration and $1 million of identity theft insurance. That benefit required no documentation.
Cash benefits came in two forms. A claimant could seek reimbursement of documented losses up to $5,000. Lost time paid up to four hours at $25 per hour, capped at $100. The alternative was a pro rata share of the remaining fund, and California residents received double the base amount. A claimant could not take both forms.
The fund also pays notice and administration costs of about $852,721, attorneys' fees of $3,333,333.33, and expenses of $65,000. Each of the 27 named plaintiffs receives a $1,500 service award.
No per-person pro rata amount has been published. That amount depends on how many claims the administrator approves, so a payment could be small.
Of 1,035,674 claim forms filed by May 4, 2026, the administrator verified 308,531. The court said many filers had Nelnet as a servicer but held loans from other lenders, so they were not class members.
Nelnet Lawsuit Updates and Case Status
Here is the current status of the Nelnet lawsuit, updated with new filings, rulings, and case-count reports as they're confirmed. The Nelnet data breach class action settled as of October 2026; the terms and timing are covered in the entries below. The full timeline below covers every verified development since the first case was filed.
Nelnet Lawsuit Timeline
Court Grants Final Approval and Dismisses the Case
Senior U.S. District Judge John M. Gerrard granted final approval to the $10 million Nelnet data breach class settlement on May 21, 2026. He awarded attorneys' fees of $3,333,333.33 and dismissed Spearman v. Nelnet Servicing, LLC with prejudice.
Fairness Hearing Held
The District of Nebraska held the fairness hearing in the Nelnet data breach settlement on May 5, 2026. The court recorded no objections, and no class members or objectors appeared.
Administrator Reports Claim Totals
As of May 4, 2026, the Nelnet settlement administrator reported 1,035,674 claim forms filed and 308,531 verified as submitted by eligible class members. Eleven verified class members had excluded themselves.
Claims, Opt-Out and Objection Deadlines Pass
March 5, 2026 was the deadline to file a claim, opt out, or object in the Nelnet data breach settlement. Late claims were rejected, and claimants could ask the court to review that decision.
Notice Period Begins
The court ordered Nelnet settlement notices sent on or before January 5, 2026. The administrator also had to launch the settlement website by that date.
Court Approves an Amended Preliminary Settlement Order
Judge Gerrard granted an amended preliminary approval order in the Nelnet data breach case on December 4, 2025. It approved amended notices and set the March 5, 2026 claim, opt-out, and objection deadlines.
Fairness Hearing Reset for November 2025
On May 16, 2025, the District of Nebraska granted a motion to continue and set the Nelnet settlement fairness hearing for November 10, 2025. The court later rescheduled it, according to the final approval order.
Court Preliminarily Approves the Settlement
Judge Gerrard certified the Nelnet settlement class and preliminarily approved the settlement on March 31, 2025. The court also approved the notice forms and the notice plan.
Plaintiffs Seek Preliminary Approval
Plaintiffs moved for preliminary approval of the $10 million Nelnet settlement on August 24, 2024. They told the court that approval would resolve all actions nationwide over the data security incident, including Carr.
Parties Sign the Settlement Agreement
Plaintiffs, Nelnet, EdFinancial, and the Oklahoma Student Loan Authority executed the Nelnet settlement agreement on August 16, 2024. The parties had signed a binding term sheet on June 11, 2024.
Oklahoma Court Stays Carr
The Western District of Oklahoma granted a stay in Carr v. Oklahoma Student Loan Authority on July 12, 2024. The stay held that Nelnet data breach suit while the parties finalized the settlement.
Binding Settlement Term Sheet Signed
The parties to the Nelnet data breach litigation signed a binding settlement term sheet on June 11, 2024. The full agreement followed on August 16, 2024.
Second Mediation Produces a Tentative Deal
A second full-day mediation before retired Magistrate Judge Jay C. Gandhi of JAMS ended on January 26, 2024 with a tentative agreement on the Nelnet settlement amount. Several material terms stayed unresolved.
First Mediation Session Held
The parties in the Nelnet data breach litigation held a first full-day mediation on December 8, 2023. Retired Magistrate Judge Jay C. Gandhi of JAMS supervised the session.
Nelnet Moves to Dismiss the Amended Complaint
Nelnet moved to dismiss the plaintiffs' amended complaint on April 24, 2023. The motion was fully briefed by July 10, 2023, and the court later terminated it after the parties reached an agreement in principle.
Plaintiffs File a Consolidated Amended Complaint
Plaintiffs filed their amended complaint against Nelnet and EdFinancial on March 10, 2023. It pleaded negligence, breach of implied contract, unjust enrichment, invasion of privacy, and state consumer protection claims.
Court Consolidates 23 Class Actions
Judge Gerrard consolidated 23 putative Nelnet data breach class actions in the District of Nebraska on January 30, 2023. He appointed Lowey Dannenberg and Silver Golub & Teitell as interim co-lead class counsel.
Carr Removed to Federal Court in Oklahoma
Carr v. Oklahoma Student Loan Authority and Nelnet Servicing, LLC, No. 5:23-cv-00099, was removed to the Western District of Oklahoma on January 20, 2023. The suit arose from the same Nelnet data security incident.
JPML Denies Centralization as MDL No. 3053
The Judicial Panel on Multidistrict Litigation denied the motion to centralize the Nelnet data breach cases as MDL No. 3053 on December 13, 2022. The Panel found informal coordination among the courts and parties quite feasible.
Plaintiffs Ask the JPML to Centralize the Cases
Plaintiffs' counsel filed a motion on September 15, 2022. It asked the Judicial Panel on Multidistrict Litigation to centralize the Nelnet data breach suits in Nebraska.
Spearman v. Nelnet Servicing Is Filed
Lowey Dannenberg and Silver Golub & Teitell filed Spearman v. Nelnet Servicing, LLC, No. 4:22-cv-3191, in the District of Nebraska on September 7, 2022. The suit began with eight plaintiffs.
First Nelnet Data Breach Complaint Filed
Herrick v. Nelnet Servicing, LLC, No. 4:22-cv-03181, was filed in the District of Nebraska on August 30, 2022. Court records list it as the earliest of the Nelnet data breach complaints reviewed here.
Notices Go Out to About 2.5 Million Borrowers
Nelnet began notifying state attorneys general and about 2,501,324 affected student borrowers of the data security incident on or around August 26, 2022. EdFinancial's notice letter carries that date.
Nelnet's Investigation Identifies the Exposed Information
According to EdFinancial's notice letter, Nelnet's investigation determined on August 17, 2022 that an unknown party could access student loan account registration information. The access ran from June 2022 to July 22, 2022.
Nelnet Tells EdFinancial It Found a Vulnerability
Nelnet notified EdFinancial on July 21, 2022 that it had discovered a vulnerability in its servicing system and customer website portal. Nelnet's team acted to secure the system, block suspicious activity, and fix the issue.
How to File a Nelnet Lawsuit
Below are the 6 steps involved in filing a Nelnet lawsuit.
- Confirm who originated your loan: Only borrowers whose loans originated with EdFinancial or the Oklahoma Student Loan Authority were class members, not every Nelnet borrower.
- Contact the settlement administrator: A.B. Data, Ltd. runs the official settlement website at nelnetsettlement.com and answers questions at info@nelnetsettlement.com.
- Ask about a late or rejected claim: The court said late claims were rejected and claimants could submit a request for review, but this page cannot confirm that route remains open.
- Activate credit monitoring if you are an authorized claimant: Authorized claimants receive an activation code by email to begin the two years of credit monitoring and identity restoration.
- Use only the official settlement website: Scam sites imitate settlement portals, so confirm the web address on your notice before entering personal details.
- Consult an attorney about independent claims: People who validly opted out kept the right to sue on their own, and only a qualified attorney can assess that option.
Nelnet Lawsuit is no longer accepting new claims. The court granted final approval on May 21, 2026. The March 5, 2026 claims deadline has passed, so no new claims can be submitted.
What Evidence Did the Nelnet Lawsuit Settlement Require?
The Nelnet lawsuit settlement required documents only for out-of-pocket loss claims. Claimants had to submit third-party proof, such as receipts, and a short note describing the loss when it was not obvious.
Self-prepared items, such as handwritten receipts, were not enough alone. They could add support to other documents.
Lost-time claims needed only a brief sworn description of the actions taken and the time spent. Credit monitoring and pro rata claims needed no documentation. The administrator also had to find each loss fairly traceable to the incident. The agreement ties that test to timing and to the type of personal information misused.
What Have Nelnet and EdFinancial Said About the Data Breach?
Nelnet and EdFinancial have said they deny violating any law and settled to avoid the cost and uncertainty of continued litigation. The final approval order records no finding for either side on the merits.
EdFinancial's notice letter says Nelnet secured its system, blocked the suspicious activity, and fixed the issue. It adds that Nelnet hired third-party forensic experts and told the U.S. Department of Education, which notified law enforcement. The letter also says EdFinancial's own systems, which Nelnet did not host, were not affected.
Defense counsel told the court at the fairness hearing that the case had valid defenses, especially because an intentional criminal actor caused the breach. Plaintiffs' counsel acknowledged risks proving causation and keeping a class together through trial.
| Party | Role | Position |
|---|---|---|
| Nelnet Servicing, LLC | Named defendant; provides the servicing system and web portal for EdFinancial and OSLA borrowers | Denies violating any law; settled to avoid expense and uncertainty |
| EdFinancial Services, LLC | Named defendant; student loan servicer whose borrowers' information was exposed | Denies wrongdoing; its notice letter names Nelnet as the portal provider |
| Oklahoma Student Loan Authority | Not named in the Nebraska case; a settling entity and a defendant in Carr | Took part in mediation and joined the settlement |
The order states that nothing in the settlement is an admission of fault, wrongdoing, or liability by the settling entities.
How Does the Nelnet Lawsuit Compare to Related Cases?
The Nelnet lawsuit differs from three related cases, and each related case is legally distinct from the data breach class action on this page.
| Matter | What It Involves | Relationship to This Case |
|---|---|---|
| Carr v. Oklahoma Student Loan Authority and Nelnet Servicing, LLC, No. 5:23-cv-00099 (W.D. Okla.) | A parallel suit over the same 2022 incident, removed to federal court on January 20, 2023 and stayed on July 12, 2024 | Same incident, separate case; plaintiffs told the court the settlement would resolve it |
| Massachusetts Attorney General settlement | A $1.8 million payment to the Commonwealth announced in January 2024 over Nelnet's income-driven repayment renewal notices from 2013 to 2017 | Unrelated to the breach; a state enforcement matter, not a class settlement |
| Johansson v. Nelnet, Inc., No. 4:20-cv-03069 (D. Neb.) | A student borrower suit filed June 15, 2020, which the plaintiffs' law firm describes as a repayment plan servicing case | Separate servicing case; CourtListener lists it as terminated June 2, 2023, and this page could not verify how it ended |
None of these matters cancels student loan balances, and neither does the data breach settlement. Its benefits are credit monitoring and cash payments, so it is not a loan forgiveness lawsuit.
Frequently Asked Questions
What is the Nelnet lawsuit about?
The Nelnet lawsuit is about a 2022 data breach on Nelnet's student loan servicing portal. Plaintiffs allege Nelnet failed to protect Social Security numbers and other personal information of about 2.5 million borrowers.
Is the Nelnet lawsuit a class action or an MDL?
The Nelnet lawsuit is a class action, not a multidistrict litigation. The JPML denied centralization as MDL No. 3053 on December 13, 2022, and the cases were consolidated in the District of Nebraska.
Did Nelnet settle the class action lawsuit?
Yes, Nelnet Servicing and EdFinancial settled the class action lawsuit for $10 million, and the court granted final approval on May 21, 2026. The settlement makes no admission of fault.
Can I still file a claim in the Nelnet lawsuit settlement?
No, the claims deadline for the Nelnet lawsuit settlement passed on March 5, 2026, so new claims cannot be filed. The court said late claims were rejected and claimants could ask it to review that decision.
When will Nelnet lawsuit settlement payments be sent?
Nelnet lawsuit settlement payments have no confirmed date, and this page could not verify that the Effective Date has occurred. The agreement sets payment within 30 days after the later of the Effective Date or the court's review of the distribution declaration.
Why were so many Nelnet settlement claims rejected?
Many Nelnet settlement claims were rejected because the filers' loans did not originate with EdFinancial or OSLA, so they were not class members. The administrator verified 308,531 of 1,035,674 claim forms filed by May 4, 2026.
Is the Nelnet lawsuit about student loan forgiveness?
No, the Nelnet lawsuit is not about student loan forgiveness. The data breach settlement pays credit monitoring and cash benefits and does not cancel or reduce any loan balance.
Is the Nelnet data breach lawsuit the same as the Carr case in Oklahoma?
No, the Nelnet data breach lawsuit and the Carr case are separate suits over the same 2022 incident. Carr was stayed pending settlement, and plaintiffs told the court the settlement would resolve it.