In re Columbia University Data Breach Litigation
| Case number | 1:25-cv-05541-PKC |
|---|---|
| Court | U.S. District Court for the Southern District of New York |
| Judge | Hon. P. Kevin Castel |
| Settlement amount | $16,125,000 |
| Defendant | The Trustees of Columbia University in the City of New York |
| Claim deadline | January 21, 2027 |
| Final approval hearing | February 23, 2027 |
| Status | Preliminarily approved; claims window open |
Columbia University has agreed to pay $16.1 million to resolve a consolidated class action over a 2025 cyberattack that exposed personal data belonging to students, applicants, employees and former students. A federal judge in the Southern District of New York granted preliminary approval to the deal on September 23, 2026, and the window to file a claim is now open.
Key takeaways
- Columbia University will pay $16,125,000 to settle litigation over a May 2025 cyberattack on its network.
- Eligible class members can claim up to $8,500 for documented losses, or a smaller flat cash payment, plus two years of credit monitoring.
- The claim deadline is January 21, 2027, with a final approval hearing set for February 23, 2027.
- The settlement combines ten lawsuits filed after Columbia disclosed that a hacker accessed Social Security numbers, academic records, financial details and health information.
What happened in the Columbia University data breach
Columbia first disclosed the cyberattack in the summer of 2025, after a June technical outage knocked out several university systems. Columbia later told the Maine Attorney General’s office that an unauthorized third party accessed its network and removed certain files on or about May 16, 2025. The university has said its investigation pointed to a politically motivated hacker rather than a financially driven one, and that it found no evidence the stolen files were sold or posted on the dark web.
The compromised data reportedly included Social Security numbers, academic records, financial account details, insurance information and medical records. Columbia’s own notice to affected individuals says the specific data exposed varied by person, so not everyone was affected the same way. The university’s count of affected individuals grew over time, from roughly 870,000 people in initial disclosures to a broader pool once state-reporting requirements were factored in.
How much the settlement pays
The $16,125,000 settlement fund covers claims, administration costs and up to $4,031,250 in attorneys’ fees. Class members with documented out-of-pocket losses tied to the breach, such as identity theft or fraud-related expenses, can claim up to $8,500. Those without documented losses may instead be eligible for a smaller flat cash payment, and all eligible class members can receive two years of credit monitoring. Columbia has also committed to strengthening its cybersecurity program going forward.
Angeion Group, LLC is administering claims under the settlement on the court’s behalf. Columbia estimates the settlement class includes roughly 2,973,631 people whose information was potentially affected.
How to file a claim
Individuals who received a notice about the Columbia University data breach can file a claim through the settlement administrator before the January 21, 2027 deadline. If you believe you were affected but never received a notice, see our guide on how to join a class action settlement for the steps to confirm your eligibility.
Frequently asked questions
What was the Columbia University data breach about?
A cyberattack discovered in 2025 allowed an unauthorized party to access Columbia University’s network and take files containing personal, academic, financial and health information belonging to students, applicants, employees and former students.
How much is the Columbia University data breach settlement worth?
Columbia agreed to pay $16,125,000. Eligible class members can claim up to $8,500 for documented losses, or a smaller flat payment without documentation, plus two years of credit monitoring.
When is the deadline to file a claim?
The deadline to submit a claim is January 21, 2027. The court will hold a final approval hearing on February 23, 2027 before payments are issued.
Who is eligible for a payment?
U.S. residents who received a notice that their personal information was involved in the 2025 Columbia University cyberattack are eligible to file a claim.
