Edfinancial Services has been the subject of two separate legal actions that borrowers may be searching for. A class action over a 2022 data breach that exposed information belonging to roughly 2.5 million borrowers ended in May 2026 with final approval of a $10 million settlement. Separately, the Consumer Financial Protection Bureau ordered Edfinancial to pay a $1 million penalty in 2022 for misleading borrowers about Public Service Loan Forgiveness. The two matters are unrelated, and they affect different groups of borrowers in different ways.
The 2022 Data Breach
The breach did not happen inside Edfinancial’s own systems. Nelnet Servicing, a Nebraska technology firm, runs the web portal and payment infrastructure used by Edfinancial and the Oklahoma Student Loan Authority. An unauthorized party exploited a vulnerability in Nelnet’s systems and accessed borrower account registration data between June and July 22, 2022. Nelnet discovered the vulnerability on July 21, confirmed on August 17 that personal information had been accessed, and began notifying borrowers and state attorneys general on August 26, 2022.
About 2,501,324 current and former Edfinancial and OSLA account holders were affected. The exposed data included names, addresses, email addresses, phone numbers, and Social Security numbers. According to Nelnet, financial account information was not exposed. Nelnet has described the breach as the work of an “intentional criminal actor” but has not publicly disclosed the specific technical vulnerability.
The $10 Million Class Action Settlement
Twenty-three putative class actions were filed against Nelnet and, in some cases, Edfinancial beginning August 30, 2022. On January 30, 2023, the U.S. District Court for the District of Nebraska consolidated the cases under Spearman, et al. v. Nelnet Servicing, LLC, Case No. 4:22-cv-3191.
The settlement created a $10 million fund for all U.S. persons whose personal information was compromised. The fund covers claims administration costs, attorneys’ fees capped at one-third of the fund, litigation expenses up to $65,000, and service awards of up to $1,500 for each of the 26 named plaintiffs, totaling $40,500. Whatever remains goes to class members who filed valid claims by the March 5, 2026 deadline.
Eligible class members chose from these forms of relief:
- Two years of credit monitoring and identity theft protection, including $1 million in identity theft insurance.
- Reimbursement of up to $5,000 for documented out-of-pocket losses tied to the breach, including fraud losses and credit freeze fees.
- Compensation for lost time at $25 per hour for up to four hours, subject to the same $5,000 cap.
- A pro rata cash payment from whatever remains in the fund after documented-loss claims. California residents at the time of the breach receive double the base pro rata amount.
Where the Settlement Stands Now
U.S. District Judge John M. Gerrard held a fairness hearing on or around May 5, 2026, and entered final judgment on May 21, 2026, dismissing the case with prejudice. No class members filed objections. The judge found the deal “fair, reasonable, and adequate under Rule 23(e)(2)” and the product of “arm’s-length negotiations.”
As of the final approval date, 308,531 claims had been verified for payment eligibility out of the roughly 2.5 million class members. No date has been set for distributing payments, and reporting on the case has noted that payments could take a year or more if there is an appeal. Class members who made errors on their claim forms can correct them through a portal on the settlement website. A.B. Data, Ltd. is administering the claims process, with updates at NelnetSettlement.com.
The claims filing deadline has passed. If you did not file by March 5, 2026, you are not eligible for a payment from this settlement, though you were still bound by the release of claims unless you opted out during the notice period.
The CFPB Action Over PSLF
The CFPB’s action against Edfinancial is a separate matter with no connection to the data breach. On March 30, 2022, the bureau issued a consent order finding that Edfinancial had engaged in deceptive practices from at least January 2017 through at least February 2021 in how it handled borrower questions about Public Service Loan Forgiveness.
The bureau found that Edfinancial misled borrowers who held Federal Family Education Loan Program loans. Representatives told borrowers they were ineligible for PSLF without explaining that consolidating FFEL loans into Direct Loans could make them eligible. In some cases, representatives said FFEL loans could not be consolidated at all. Edfinancial also gave borrowers inaccurate information about whether past payments counted toward the 120-payment PSLF requirement, which jobs qualified, and often failed to mention PSLF at all when borrowers asked about loan forgiveness.
The CFPB ordered Edfinancial to pay a $1 million civil penalty. The consent order also required Edfinancial to contact all FFEL borrowers about the Department of Education’s temporary PSLF waiver, which allowed retroactive credit for payments made on FFEL loans before the waiver expired on October 31, 2022. Edfinancial was required to designate specialized PSLF staff, update its phone system to route callers to those specialists, run a training program requiring 90% accuracy on assessments, and keep recordings of all calls with FFEL borrowers. Edfinancial said it “strenuously rejects” the allegations but did not admit or deny the findings under the consent order.
If you had FFEL loans serviced by Edfinancial and were told you did not qualify for PSLF, the CFPB action does not create an individual payout. The waiver window it referenced has closed, but borrowers with FFEL loans should still check current PSLF rules and consolidation options at StudentAid.gov before assuming they are ineligible.