Nelnet class action claims data breach exposed personal information of more than 2.5M individuals

Nelnet data breach class action lawsuit overview: 

• Who: Michael Varlotta filed a class action lawsuit against Nelnet Servicing LLC. 
• Why: Varlotta claims Nelnet failed to safeguard the personally identifiable information of its student loan borrowers during a recent data breach. 
• Where: The class action lawsuit was filed in Nebraska federal court. 

Student loan services company Nelnet failed to properly secure and safeguard the personally identifiable information of more than 2.5 million borrowers during a recent data breach of its servers, a new class action lawsuit alleges. 

Plaintiff Michael Varlotta claims Nelnet bears responsibility for a data breach of its servers which exposed borrowers unencrypted and unredacted names, phone numbers, email addresses, and Social Security numbers. 

“Plaintiff’s and Class Members’ unencrypted, unredacted PII was compromised due to Nelnet’s negligent and/or careless acts and omissions, and due to the utter failure to protect Class Members’ sensitive data,” states the Nelnet class action. 

Varlotta argues Nelnet, in addition to allegedly failing to safeguard the data, also “failed to provide timely, accurate and adequate notice” to student loan borrowers who were affected by the Nelnet data breach. 

“Current and former borrowers’ knowledge about what PII Nelnet lost … was unreasonably delayed by Nelnet’s unreasonable notification delay after it first learned of the data breach,” states the Nelnet class action. 

Varlotta wants to represent a nationwide class of student loan borrowers whose personally identifiable information was compromised in the Nelnet data breach announced by the company in August 2022. 

Nelnet accused of failing to explain why it took more than a month to notify borrowers about the data breach

Nelnet notified state attorney generals on or around Aug. 26 that unauthorized individuals had gained access to its systems and acquired and accessed files on its network, according to the Nelnet class action. 

Varlotta claims Nelnet chose not to notify student loan borrowers, however, on July 21, “instead choosing to address the incident in-house by implementing other alleged safeguards to some aspects of its computer security.” 

Nelnet subsequently “failed to explain” why it took over a month for it to notify student loan borrowers to alert them that their personally identifiable information had been exposed in the data breach, the Nelnet class action alleges. 

Varlotta claims Nelnet is guilty of negligence, unjust enrichment, invasion of privacy, and breach of implied contract. 

Plaintiff is demanding a jury trial and requesting declaratory and injunctive relief along with an award of actual, nominal, consequential, and punitive damages for himself and all class members. 

Last month, President Joe Biden announced that he would be forgiving up to $20,000 for student loan borrowers across the country and extending the repayment moratorium through the end of the year. 

Was your personally identifiable information exposed in the Nelnet data breach? Let us know in the comments! 

The plaintiff is represented by J.L. Spray and Jacob C. Garbison of Mattson Ricketts Law Firm, and Brandon M. Wise of Peiffer Wolf Carr Kane Conway & Wise, LLP. 

The Nelnet data breach class action lawsuit is Varlotta v. Nelnet Servicing LLC, Case No. 4:22-cv-03188, in the U.S. District Court for the District of Nebraska.

Read About More Class Action Lawsuits & Class Action Settlements:

• KeyBank class action alleges company’s negligence contributed to data breach
• LastPass data breach leads to theft of source code, proprietary technical information
• DoorDash data breach exposes customers’ personal, financial information
• Top mobile carriers including Verizon, AT&T, T-Mobile share data privacy practices