Columbia University data breach settlement ($16.1M, up to $8,500)

Columbia University has agreed to pay $16,125,000 to settle a consolidated class action over a cyberattack on its network that began in May 2025. People whose information was exposed can file a claim for reimbursement of documented losses up to $8,500, or choose a cash payment instead, and can also request two years of free credit monitoring. Claims must be filed online or postmarked by January 21, 2027.

The case is In re Columbia University Data Breach Litigation, No. 1:25-cv-05541 (PKC), in the U.S. District Court for the Southern District of New York. Judge P. Kevin Castel granted preliminary approval on September 23, 2026. The court has not yet granted final approval, and Columbia denies any wrongdoing. Claiming requires the Notice ID printed on the notice sent to class members.

The defendant is the Trustees of Columbia University in the City of New York, the legal name of Columbia University, a private research university in Manhattan. The settlement agreement says it stores personal information about employees, students, applicants and alumni. Columbia's lawyers are at Debevoise & Plimpton LLP.

The plaintiffs are 18 class representatives who filed or joined the ten lawsuits that were combined into this case. The first-filed case was Quintero v. Columbia. The court appointed four lawyers as class counsel: William B. Federman of Federman & Sherwood, Ashley M. Crooks of Hausfeld LLP, Rachele R. Byrd of Wolf Haldenstein Adler Freeman & Herz LLP and Charles E. Schaffer of Levin Sedran & Berman, LLC.

Angeion Group, LLC is the court-appointed settlement administrator and runs ColumbiaUniversityDataSettlement.com.

These dates come from Columbia's notices to state attorneys general, its public statements and the court record.

• On or about May 16, 2025: an unauthorized third party gained access to Columbia's network through a publicly exposed system, according to Columbia's letter to the Rhode Island Attorney General.
• June 24, 2025: a technical outage disrupted some Columbia IT systems. Columbia says it started an investigation and notified law enforcement.
• July 2, 2025: Columbia told its community that an unauthorized party had accessed its network, stolen data and disrupted its systems.
• July 8, 2025: Columbia determined that the stolen data included Social Security numbers and birth dates.
• August 7, 2025: Columbia began mailing notices. Its filing with the Maine Attorney General listed 868,969 affected people at that time and offered 24 months of Kroll monitoring.
• December 30, 2025: Columbia began notifying additional people found later in its investigation, according to a January 2026 update.
• September 23, 2026: the court granted preliminary approval.
• October 23, 2026: Columbia said people affected by the attack would receive claim instructions from Angeion. The agreement sets notice to begin 30 days after preliminary approval.

Columbia's letters say the files came from student admissions, financial aid and certain employee databases. Depending on the person, the exposed data may include names, birth dates, Social Security numbers, contact details, demographic information, academic history, financial aid information, and insurance and health information shared with the university. Columbia said it had no evidence that medical center patient records were affected.

The plaintiffs claimed negligence, breach of implied contract, unjust enrichment, breach of bailment, invasion of privacy under California's constitution and violations of consumer protection and data laws in Connecticut, Texas, Maryland, New York, New Jersey, Pennsylvania, California and Tennessee. They also asked for a declaratory judgment. In plain terms, they say Columbia did not adequately protect the information it held.

Columbia "denies any wrongdoing or liability," according to the court-approved notice. In an October 23, 2026 update, Columbia said its investigation found the attack was carried out by a hacker whose stated motivation was political, and that it found no evidence the data had been sold or distributed on the dark web. Both sides agreed to settle to avoid the risk, cost and time of continued litigation.

Judge Castel found the settlement class can likely be certified for settlement purposes and approved the notice plan. He has not decided whether the settlement is fair, and no court has found that Columbia broke any law. If final approval is denied, no benefits will be paid.

The preliminary approval order defines the class as all individuals living in the United States whose private information was potentially accessed by unauthorized third parties during the cyberattack, including everyone who was sent notice of it. Columbia estimates in the settlement agreement that the class includes 2,973,631 people. That is far more than the 868,969 it first reported in August 2025. Columbia's January 2026 update said its continuing investigation had identified additional affected people.

The notice calls this a closed class. Benefits are available only to class members with a unique Notice ID, and claims from anyone else will be rejected. Excluded are Columbia and its affiliates, officers and directors, Columbia's lawyers and their immediate families, the judges on the case and their families, and anyone who opts out.

If you think you were affected but cannot find a notice, call the administrator at 1-833-617-4373.

• Find your notice from Angeion, sent by mail or email. It contains your Notice ID.
• File a claim at ColumbiaUniversityDataSettlement.com by January 21, 2027. The notice says online filing is the quickest route.
• If you prefer paper, print the claim form from the site and mail it to Columbia University Data Settlement Administrator, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103, postmarked by January 21, 2027.
• Pick one cash option, then decide whether to add credit monitoring.
• Choose PayPal, Venmo, Zelle or a paper check for payment.

You choose one of two cash options, and you can add credit monitoring to either.

Documented losses: reimbursement up to $8,500 for losses fairly traceable to the cyberattack. These can include unreimbursed costs from identity theft or fraud, falsified tax returns, related costs such as notary, postage, copying or mileage, and credit monitoring you paid for. Losses must have occurred on or after May 16, 2025, and must involve the same type of information exposed in the attack. You need documents not prepared by you, such as receipts or bank statements. Handwritten receipts alone are not enough. If your approved loss award is smaller than the alternative cash payment, you get the larger amount.

Alternative cash payment: an equal share of what is left in the fund after attorneys' fees and expenses, service awards, administration costs, credit monitoring costs and documented loss claims. The notice gives no dollar amount, and payments may be reduced pro rata depending on how many people file.

Credit monitoring: two years of three-bureau credit monitoring, dark web monitoring, up to $1,000,000 in identity theft insurance and identity recovery services. This is separate from the Kroll service Columbia offered in 2025.

Columbia also agreed to keep added security measures in place for three years after the settlement takes effect. Class counsel will ask for up to 25% of the fund, or $4,031,250, plus expenses, and $500 for each class representative.

• December 22, 2026: deadline to opt out or object, by mail postmarked by this date.
• January 21, 2027: claim deadline, online or postmarked.
• February 23, 2027, 2:00 p.m. Eastern: final approval hearing in Courtroom 11D, Daniel Patrick Moynihan U.S. Courthouse, 500 Pearl Street, New York.

If you stay in the class, you give up the right to sue Columbia and the other released parties over the claims this settlement resolves, whether or not you file a claim. To keep that right, you must mail a signed exclusion request. You cannot opt out by phone or email. Objections must be mailed to the administrator or filed with the court by the same deadline and must include the details listed in the notice.

• Consolidated case: several related lawsuits combined before one judge.
• Preliminary approval: a judge's early finding that a settlement looks fair enough to notify the class.
• Pro rata: divided in proportion, so each share shrinks as more valid claims are filed.
• Notice ID: the unique code on your settlement notice that the administrator uses to confirm you are in the class.
• Service award: a payment to a class representative for their role in the case.

The court will consider final approval on February 23, 2027. The date can change, and updates will be posted on the official site. If the court approves the settlement and no appeals are filed, payments and credit monitoring enrollment will follow. The alternative cash amount will not be known until claims are counted.

Settlement terms come from the official website, notice, claim form, settlement agreement and preliminary approval order. Incident dates come from Columbia's letters to state attorneys general and its public updates. No official document gives the expected alternative cash amount, so this page does not estimate it. The notice does not name the settlement credit monitoring provider.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.