Nelnet Servicing Student Loan Info Data Breach Class Action

Nelnet Servicing, LLC provides technology and web-based services to those who service student loans, such as Oklahoma Student Loan Authority (OSLA) and Edfinancial Services, LLC. At some point, possibly in June or July 2022, the complaint for this class action alleges, it suffered a data breach that exposed the personally identifiable information (PII) of some 2,500,000 people, some of whom, the complaint claims, still do not know that their information was obtained.

The class for this action is all natural persons living in the US whose PII was compromised in the 2022 data breach announced by Nelnet, OSLA, or Edfinancial on or around August 26, 2022.

The complaint alleges that Nelnet began to acknowledge the data breach on or around August 26, admitting it had been hacked and that PII and sensitive personal information (SPI) such as Social Security numbers had been taken. According to the complaint, Nelnet did not provide exact dates for the data breach, other than to say it had probably been in June or July, but it did begin notifying clients OSLA and Edfinancial around July 21, 2022.

The information taken, the complaint alleges, included Social Security numbers, names, addresses email addresses, and telephone numbers. None of the above three companies, the complaint alleges, have posted any notice about the data breach on their websites.

Nelnet claimed to respect the need to protect the private information it stored. The complaint quotes its Privacy Policy as saying, “Nelnet takes careful steps to safeguard customer information. …. We maintain reasonable and appropriate physical, electronic, and procedural safeguards to guard your Nonpublic Personal Information (NPI) and Personally Identifiable Information (PII) and we regularly test those safeguards to maintain the appropriate levels of protection.”

Also on August 26, 2022, Nelnet announced that on July 21, 2021 [2022?], it had told Edfinancial and OSLA “that it had discovered a vulnerability it believed led to this incident. Nelnet Servicing informed Edfinancial and OSLA that Nelnet Servicing’s cybersecurity team took immediate action to secure the information system, block suspicious activity, fix the issue, and launched an investigation with third-party forensic experts to determine the nature and scope of the activity.”

This investigation, Nelnet said, also found that “certain student loan account registration information was accessible by an unknown party beginning in June 2022 and ending on July 22, 2022.” The complaint faults Nelnet for the vagueness of its information about the data breach.

The complaint alleges, “Appallingly, [Nelnet] is offering no additional assistance to Plaintiffs and class members beyond the entirely inadequate monitoring suggestions that are a part of its notice. Edfinancial and OSLA both state that they are offering 24 months of credit monitoring through Experian.”

The complaint claims that this is not the first time that Nelnet has failed to adequately protect information: “In 2011, a Nelnet employee was charged with using student information to fraudulently open credit cards and loans.”

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy