Scholly and Path Founder Files Whistleblower Lawsuit Against Sallie Mae, Alleging the Company Is Using a Shell Company to Sell Millions of Students' Data

Rhea-AI Summary

Argus Apr 29 session

-1.88% close to close Open Argus

Details

News Market Reaction – SLM

On Apr 29, the day this news came out, SLM closed 1.88% below the previous close.

Data tracked by StockTitan Argus for the Apr 29 session.

Key Figures

Backpack Media audience: 8.5 million students, families, and young professionals Scholly users: 5 million users Scholarship funding enabled: more than $100 million +3 more

Backpack Media audience

8.5 million students, families, and young professionals

Marketing materials for Backpack Media platform

Scholly users

5 million users

Scale of Scholly scholarship-matching platform

Scholarship funding enabled

more than $100 million

Scholarship funding accessed via Scholly

Founder scholarships won

approximately $1 million

Scholarships Gray won to attend college

Launch date Backpack Media

March 4, 2026

Public launch date of Backpack Media platform

Court filing date

April 13

Date Gray filed complaint in open court

Historical Context

5 past events · Latest: Apr 23

5 events

1. Apr 23

   Earnings results

   24h Move

   +1.8%

   Q1 2026 results and raised full‑year diluted EPS guidance.

2. Apr 22

   Dividend declaration

   24h Move

   +1.4%

   Declared Q2 dividends on preferred Series B and common stock.

3. Apr 16

   Educational resources

   24h Move

   +3.6%

   Guidance and tools to help families interpret financial aid offers.

4. Apr 08

   Earnings date notice

   24h Move

   -1.2%

   Announcement of timing and access details for Q1 2026 results.

5. Mar 17

   Product expansion

   24h Move

   -0.9%

   Expanded graduate loan options for medical and dental students.

24h Move is the share-price change in the day after each event; other market factors may also have contributed.

Key Terms

gramm-leach-bliley act, fdic-insured, nonpublic personal financial information, office of the whistleblower, +3 more

7 terms

gramm-leach-bliley act regulatory

"a federally regulated, FDIC-insured bank covered by the Gramm-Leach-Bliley Act (GLBA)"

A federal law that requires banks, insurance companies, and other financial firms to protect customers’ personal and financial information, give clear privacy notices, and limit how that data is shared. Think of it as household rules for handling sensitive paperwork: firms must lock, explain, and get consent before passing it on. Investors care because noncompliance can lead to fines, costly fixes, damaged reputation, and higher regulatory scrutiny that can affect profits and stock value.

fdic-insured regulatory

"Salliemae.com is operated by Sallie Mae Bank, a federally regulated, FDIC-insured bank"

"FDIC-insured" means that a bank or savings institution is protected by the Federal Deposit Insurance Corporation, which guarantees that depositors will get back their money up to a certain limit if the bank fails. This insurance provides peace of mind, similar to a safety net, ensuring that your savings are protected even if the bank encounters financial trouble. It helps build trust and confidence for people saving or investing their money in banks.

nonpublic personal financial information regulatory

"which prohibits banks from selling nonpublic personal financial information"

Nonpublic personal financial information is any private financial data about an individual that is not available to the general public, such as account numbers, transaction histories, credit reports, income details, investment holdings, or mortgage information. For investors, it matters because mishandling or exposing this kind of data can trigger legal penalties, loss of customer trust and reputational damage—similar to a company losing a locked file of clients’ finances—and can lead to financial costs and regulatory scrutiny.

office of the whistleblower regulatory

"filed a formal whistleblower complaint with the U.S. Securities and Exchange Commission's Office of the Whistleblower"

An office of the whistleblower is a government agency unit that receives and evaluates confidential tips from insiders about illegal or unethical practices, then helps trigger investigations and enforcement. Think of it as an official tip line that offers protections and sometimes financial awards to people who expose fraud or safety risks; its activity matters to investors because it can surface problems that affect a company’s value and prompt regulatory action or fines.

section 21f regulatory

"under the anti-retaliation provisions of the Delaware Whistleblowers' Protection Act and Section 21F of the Securities Exchange Act"

Section 21F is the part of U.S. securities law that lets individuals who report suspected securities fraud to regulators earn monetary awards and receive confidentiality and anti‑retaliation protections. For investors it matters because whistleblower tips often trigger regulatory investigations or enforcement actions that can materially change a company's financial outlook and stock price—like a neighborhood tip prompting an inspection that uncovers hidden risks.

dodd-frank act regulatory

"Section 21F of the Securities Exchange Act, as amended by the Dodd-Frank Act"

A U.S. law that created a set of rules and oversight for banks, financial firms, and certain markets to reduce risky behavior and protect consumers. Think of it as a referee and rulebook for the financial system: it imposes disclosure, capital and reporting requirements and oversight that can change how banks lend, trade and manage risk, which in turn affects investment returns, borrowing costs and overall market stability.

mandatory arbitration agreements regulatory

"Sallie Mae borrowers and employees are typically bound by mandatory arbitration agreements"

A mandatory arbitration agreement is a contract clause that requires parties to settle disputes through a private arbitrator instead of in public courts, similar to agreeing to resolve a fight in a private meeting rather than a courtroom. For investors this matters because it can limit class-action lawsuits, change the likely cost and speed of legal claims, and affect a company’s legal risk profile, potential liabilities, and public reputation—factors that can influence valuation and volatility.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

Complaint alleges Sallie Mae established a plan and scheme to circumvent federal data-privacy protections related to the use and disclosure of student data, and retaliated against the executive who reported it.

WILMINGTON, Del., April 29, 2026 /PRNewswire/ -- Christopher Gray, founder of scholarship-matching platform Scholly and current CEO of AI test-prep platform Path, has filed a whistleblower and data-privacy lawsuit against SLM Corporation (NASDAQ: SLM), the parent company of Sallie Mae Bank, and its non-bank subsidiary SLM Education Services, LLC, in Delaware Superior Court. The complaint alleges that Sallie Mae built a deliberate corporate structure to sell the personal data of millions of students, including minors, while evading the federal privacy law that would otherwise prohibit it.

At the heart of the complaint is a two-entity structure. Salliemae.com is operated by Sallie Mae Bank, a federally regulated, FDIC-insured bank covered by the Gramm-Leach-Bliley Act (GLBA), which prohibits banks from selling nonpublic personal financial information. Sallie.com website is almost identical, holds the same branding, including logo and brand colors,  but is operated by a different entity: SLM Education Services, LLC, a non-bank subsidiary not subject to those restrictions. Sallie.com's publicly posted privacy policy states, in the company's own words, that it "sells" and "shares" personal information, including sensitive personal information, for advertising and marketing purposes.

The complaint alleges this architecture was designed to circumvent GLBA, which prohibits a financial institution from disclosing nonpublic personal information to nonaffiliated third parties, directly or through any affiliate.

The impact of this scheme reaches millions of users. On March 4, 2026, Sallie Mae publicly launched Backpack Media, an advertising platform operated through SLM Education Services. Its marketing materials offer brands access to an audience of "8.5 million students, families, and young professionals", most of them are minors looking for student loans and scholarships.

Gray has also filed a formal whistleblower complaint with the U.S. Securities and Exchange Commission's Office of the Whistleblower regarding the matters at issue in the litigation. By making these filings, Gray is protected under the anti-retaliation provisions of the Delaware Whistleblowers' Protection Act and Section 21F of the Securities Exchange Act, as amended by the Dodd-Frank Act. Any further retaliatory conduct by Sallie Mae, including continued pressure on Gray, his current company, or his former Scholly shareholders, is itself actionable under both statutes and subject to additional federal and state penalties.

Sallie Mae acquired Scholly in June 2023, and Gray joined the company as a senior executive. According to the complaint, he discovered the data-monetization plan and raised concerns internally. Executives knew Gray was planning to bring those concerns directly to Sallie Mae CEO Jon Witter at a breakfast meeting scheduled through the CEO's office. He was abruptly terminated before that meeting could take place.

After the termination, Sallie Mae's Chief Legal Officer, Nicholas Jafarieh, met with Gray's counsel. According to the complaint, he admitted the company "handled [Gray's] termination wrong." In the same meeting, he warned that Gray did not "want to make an enemy" of the company.

As alleged in the complaint, in the lead-up to the filing, Sallie Mae made repeated threats to compel Gray's claims into private, confidential arbitration to keep the allegations off the public record. When that pressure failed and Gray filed his complaint in open court on April 13, the company escalated in a different direction. Its outside counsel sent a demand letter to Gray's former Scholly shareholders and explicitly tied a threat of financial clawback to Gray's communications with the press.

"I built Scholly to help students access money for college, not to help a bank sell their personal information to advertisers," Gray said. "When I saw what was happening inside Sallie Mae, I reported it. What followed was a campaign to keep the matter out of public view — their response was to fire me, threaten me, and try to silence me. Sallie Mae borrowers and employees are typically bound by mandatory arbitration agreements that keep disputes out of open court. This case is different as I'm protected, I can speak and I will."

The complaint is a matter of public record in Delaware Superior Court. A copy is available upon request.

Christopher Gray is the founder of Scholly, a scholarship-matching platform that grew to 5 million users and helped students access more than $100 million in scholarship funding. Gray appeared on ABC's Shark Tank in 2015 and 2024 and was named to the Forbes 30 Under 30 list. Originally from Birmingham, Alabama, Gray won approximately $1 million in scholarships to attend college which inspired him to create Scholly. He is currently the founder and CEO of Path, an AI-powered test-prep platform for K-12 students. He is represented in this matter by Allen and Associates.

Path is an AI-powered test prep platform founded by Christopher Gray. The platform offers AI-driven test preparation for K-12 state exams, college admissions, and professional certifications.

View original content to download multimedia:https://www.prnewswire.com/news-releases/scholly-and-path-founder-files-whistleblower-lawsuit-against-sallie-mae-alleging-the-company-is-using-a-shell-company-to-sell-millions-of-students-data-302757439.html

SOURCE Christopher Gray