"Hackers obtained their [personally identifiable information] because of its value in exploiting and stealing the identities of Plaintiff and similarly situated Class Members," the case reads. "The risks to these persons will remain for their respective lifetimes." According to the complaint, Nelnet first began notifying state attorneys general about a "widespread data breach" of its computer network on August 26 of this year. In its letter sent to victims, Nelnet revealed that it discovered on July 21 that an unauthorized party had accessed a portion of its information system and network, the suit says. Rather than notify victims immediately, Nelnet chose to address the incident "in-house by implementing other safeguards to some aspects of its computer security" and investigating with "third-party forensic experts" before "simply resum[ing] its normal business operations," the lawsuit states. "Nelnet failed to uphold its data security obligations to Plaintiff and Class Members," the suit alleges.