Fraudulent Student Loans

Location: FL, USA

My school leaked my information in a third party data breach. It was almost immediately used to take out 6k in fraudulent student loans at CRI, a federal loan servicer. The federal department of education does not verify identity or check credit before turning around and informing CRI they are clear to issue loans. I've already made a police report, FTC report, and fraud alert at my credit bureaus. I turned all of my police reports and FTC reports in to CRI. The loans have fallen off my credit report at at least one bureau because they consider a police report and FTC report to be sufficient. Months later, CRI has sent a letter back stating that they will only initiate a fraud investigation if I turn in the following information:

-Drivers license (already provided this to reclaim my account) -Proof of my current address -My birth certificate -High school transcripts

Resolving credit card fraud, or even bank fraud, from what I've heard, is as simple as saying "I didn't do that", and the bank will internally investigate. I've already spent 20-30 hours of my own time researching, filling out reports, making calls, etc, to resolve this, and I'm incredibly exhausted. This additional request will most likely add another 5-10 hours (my high school was a humongous pain in the ass to deal with, and they frequently had 'computer freezes' where they would intentionally refuse to issue transcripts for alumni that lasted weeks at a time.) Furthermore, if someone else has already provided fraudulent versions of this information to CRI to assume my identity, why should I believe that my information would actually overrule theirs as 'correct'? I'm also deeply uncomfortable at sharing more sensitive information with an agency that has already played a part in mishandling my personal information.

I was advised by a friend who had dealt with identity theft not to create a CRI account, but it was needed to file my police reports, and the police detective on my case advised me to make one as well. When I created an account, it linked to the fraudulent loans. Was that a mistake, and did I accept some sort of responsibility for the loans when I created this account? Am I legally liable for them now that I've acknowledged them?

Why isn't the burden of proof for ownership of loans on CRI, and why isn't it on ED? Why is the verification process for discharging the loans more involved than the verification for taking them out in the first place? Can I hold either entity, or my school or their third-party agency, legally liable for mishandling my personal information, or for issuing a loan on my behalf with little or no verification?

The police detective investigating my case said a false phone number and email were used to initiate the loans, and both have already been discarded by the user. If CRI can't identify an individual responsible for the theft, do they have any legal grounds to require me to repay the loans?

Last question. I received a letter from the third-party who allegedly leaked my information. I was skeptical of it as it named itself as a data handler for school employees, and I was only ever a student. I researched the breach and found very little about that third-party company or the school. There were a few very small class-action lawsuits, but I'm not sure if they are legitimate or a means for further mining data. Is there a way to verify a law firm or class-action lawsuit for legitimacy? Legitimate or not, the one class-action page I reviewed stated no affected parties, meaning I would be the first/only affected party for this case. If I decided I wanted to sue as an affected party, would I need to retain a lawyer, and what steps would I take next?

I assume people report loans they actually have taken out, hence the amount of verification and suspicion. But I am incredibly frustrated. Any advice is incredibly appreciated. Thank you!