What they're not telling you: # Nelnet's $10M company-voyager-digital-charges-former-execut.html" title="FTC Reaches Settlement with Crypto Company Voyager Digital; Charges Former Executive with Falsely Claiming Consumers’ Deposits Were Insured by FDIC" style="color:#1a1a1a;text-decoration:underline;text-decoration-style:dotted;font-weight:500;">Settlement: The Price of Exposing 2.3 Million Americans' Financial Records A student loan processor that manages federal education debt for millions of Americans negotiated down to $10 million in damages after exposing the personal financial information of 2.3 million borrowers—a settlement that works out to roughly $4.35 per compromised individual. Nelnet Inc., the Nebraska-based servicer that handles federal student loans for the Department of Education, disclosed in 2017 that a data breach had exposed names, Social Security numbers, dates of birth, and account information belonging to 2.3 million people. The company eventually agreed to pay $10 million in a class action settlement, final approval granted through the courts.
What the Documents Show
That figure deserves scrutiny not for what it is, but for what it reveals about how data breaches get priced in America. The settlement structure itself demands examination. Class action lawsuits involving data breaches typically produce settlements where the headline number masks the actual distribution. In the Nelnet case, the $10 million gets divided among settlement administration costs, plaintiff's attorney fees—typically 25 to 30 percent of the settlement pool—and then distributed among the 2.3 million affected individuals. The math here is unambiguous: most people whose Social Security numbers were exposed will receive checks for single-digit or low double-digit amounts, if they file claims at all.
Follow the Money
The lawyers will walk away with $2.5 to $3 million. Settlement administration firms will extract another $500,000 to $1 million in fees. Nelnet's actual loss becomes something closer to $5 million, which the company can write off against taxes, further reducing the net cost. What matters more is what Nelnet paid in the years between the breach discovery and final settlement approval. The company continued servicing federal student loans—a guaranteed revenue stream worth hundreds of millions annually, according to SEC filings. The Department of Education never stripped Nelnet of its servicer status.
What Else We Know
No federal regulator yanked the company's authority to handle sensitive financial data for 8 million borrowers. The breach did not interrupt Nelnet's business model; it merely tacked on a litigation expense smaller than quarterly earnings. Nelnet's parent company, which operates multiple financial services divisions, reported revenues of $2.4 billion in 2020. The $10 million settlement represents 0.41 percent of annual revenue—a cost of doing business when the business itself depends on access to federal student loan data that the government essentially outsources to private companies with minimal security oversight. The larger structural question gets buried: Why does a company that lost control of 2.3 million Americans' Social Security numbers remain authorized to handle 8 million more borrower records? The Department of Education's servicer oversight mechanisms proved inadequate to the breach.
Primary Sources
- Source: r/privacy
- Category: Corporate Watchdog
- Cross-reference independently — don't take our word for it.
Disclosure: NewsAnarchist aggregates from public records, API feeds (Federal Register, CourtListener, MuckRock, Hacker News), and independent media. AI-assisted synthesis. Always verify primary sources linked above.