Settlement
Claims open

Columbia University data breach settlement

$16,125,000 settlement fund paid by the Trustees of Columbia University, covering claims, credit monitoring, administration, attorneys' fees and service awards, plus security commitments Columbia must keep for three years. source

In re Columbia University Data Breach Litigation 路 Case No. 1:25-cv-05541 (PKC) 路 U.S. District Court for the Southern District of New York 路 Judge P. Kevin Castel

Where it stands

Claims open: 71 days left to file, until Jan 21, 2027.

The court granted preliminary approval on September 23, 2026. Claims are open until January 21, 2027 and the final approval hearing is set for February 23, 2027; nothing is paid until the court approves the settlement and it becomes final. Official update, Nov 12, 2026

File a claim on the official site
  1. Find the Notice ID number on the postcard or email notice you received; the class is closed and claims without one are rejected.
  2. On the official site's Submit Claim page, choose either the alternative cash payment or reimbursement of documented losses, not both.
  3. For documented losses, enter the amount, describe each expense and attach proof such as a bank or credit card statement.
  4. Tick the box for two years of credit monitoring if you want it, and pick PayPal, Venmo, Zelle or a paper check.
  5. Submit online by January 21, 2027, or mail the paper form, postmarked by that date, to Columbia University Data Settlement Administrator, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103.

MrScandal is not the settlement administrator and does not take claims. The administrator is Angeion Group, LLC (appointed in the court papers).

Who qualifies

  • Individuals living in the United States whose private information was potentially accessed by an unauthorized third party in Columbia's May 2025 cyberattack, including everyone who was sent a notice about it. source
  • Columbia estimates the class at 2,973,631 people. It is a closed class: benefits go only to class members with a unique Notice ID number, and claims from anyone else are rejected. source
  • The class can include people with no apparent connection to Columbia. The university says their information reached it through student recruitment services that passed on details from prospective students. source
  • Not included: Columbia and its affiliates, officers and directors; Columbia's counsel and their families; judges on the case and their families; and anyone who opts out by December 22, 2026. source

What each group gets

WhoAmount
Documented lossesUp to $8,500 for unreimbursed losses from identity theft or fraud, falsified tax returns or other misuse of the data, related costs such as postage and mileage, and credit monitoring bought on or after May 16, 2025. Third-party proof such as bank or card statements is required; self-prepared documents alone are not enough.
Alternative cash payment (instead of documented losses)A share of what remains after fees, expenses, service awards, administration, credit monitoring and documented-loss claims. No per-person figure has been published; the notice says the fund is expected to cover all eligible claims but payments may be reduced pro rata.
Everyone who claimsTwo years of three-bureau credit monitoring, dark web monitoring, identity theft insurance up to $1,000,000 and identity recovery services, on top of the cash option chosen.
Documented-loss claims below the cash paymentIf an approved documented-loss award comes out lower than the alternative cash payment, the claimant receives the larger amount.
Requested from the fund before class membersClass counsel will ask for attorneys' fees of up to 25% ($4,031,250) plus expenses, and $500 for each class representative. The court decides at the final hearing.

Key dates

  1. Jun 24, 2025 Columbia says it has no evidence of unauthorized access to its systems after this date source
  2. Jul 2, 2025 Columbia tells its community that an unauthorized party accessed its network, stole data and disrupted systems source
  3. Aug 7, 2025 Columbia begins mailing breach notices source
  4. Dec 30, 2025 Notices to additional people found in the continuing investigation begin source
  5. Apr 10, 2026 First Amended Consolidated Class Action Complaint filed source
  6. Sep 23, 2026 Preliminary approval granted; Angeion Group appointed administrator source
  7. Dec 22, 2026 Deadline to opt out or object (postmarked) source
  8. Jan 21, 2027 Claim deadline source
  9. Feb 23, 2027 Final approval hearing before Judge P. Kevin Castel, 2:00 p.m. ET source

What the case was about

Compiled by the MrScandal settlements desk from the documents below 路 Desk editor Laima 膾rk拧姆e-Kreicberga 路 Updated Nov 12, 2026

On July 2, 2025 Columbia University told its community that an unauthorized party had accessed its network, stolen data and disrupted its systems. In an August 5 update it said the stolen information included Social Security numbers, contact details, demographic information, academic history, financial aid and insurance-related information and certain health information, mainly of students and applicants, with some employee data as well. It said it had no evidence of unauthorized access after June 24, 2025, had found no sign that Columbia University Irving Medical Center patient records were affected, and had notified law enforcement. Mailed notices began on August 7, 2025, with two years of free credit monitoring.

The investigation kept finding more people. Columbia began a further round of notices on December 30, 2025 and said on June 3, 2026 that notification was complete. Some recipients had never applied to or attended Columbia; the university said their information appears to have come from student recruitment services that historically passed prospective students' details, such as test scores, to colleges, and that it was removing those people's Social Security numbers. On October 23, 2026 Columbia said the attack was carried out by a hacker whose stated motivation was political, and that it had found no evidence of a financial motive or that the data was sold or distributed on the dark web.

Ten lawsuits filed in federal court in Manhattan were consolidated before Judge P. Kevin Castel. The plaintiffs alleged negligence, breach of implied contract, unjust enrichment, breach of bailment, invasion of privacy and violations of consumer protection laws in several states, arguing that Columbia failed to protect data it collected from employees, students, applicants and alumni.

The parties settled after mediation for $16,125,000, for a class Columbia estimates at 2,973,631 people. The agreement says the case is resolved "without any admission of liability or wrongdoing" and that Columbia "denies all allegations of wrongdoing, fault, liability, and damages." Columbia also committed to keep its added security measures for three years. Judge Castel granted preliminary approval on September 23, 2026.

Questions people ask

How much will I get from the Columbia University data breach settlement?

Either reimbursement of documented losses up to $8,500 or an alternative cash payment whose size depends on how many people claim. No per-person cash figure has been published. Both come with an option for two years of credit monitoring. source

What is the deadline for the Columbia data breach claim?

Claims must be submitted online or postmarked by January 21, 2027. Opt-outs and objections must be postmarked by December 22, 2026. source

I never went to Columbia. Why did I get a data breach letter?

Columbia says people with no known connection to it were in its systems because student recruitment services historically passed on information from prospective students who chose to share it, such as test scores or requests for information about schools or scholarships. source

Do I need a Notice ID to file a Columbia settlement claim?

Yes. The notice calls this a closed class: benefits are available only to class members with a unique Notice ID number, and claims from non-members are rejected. If you lost yours, call the administrator at 1-833-617-4373. source

When will Columbia settlement payments be sent?

Only after the court grants final approval and the settlement becomes final. The final approval hearing is set for February 23, 2027, and any appeal would delay payment. Payment can be by PayPal, Venmo, Zelle or paper check. source

Did Columbia admit wrongdoing?

No. Columbia denies any wrongdoing or liability, and the court has not decided that any law was broken. source

Status history

  1. Jul 2, 2025 Columbia discloses the cyberattack to its community. source
  2. Aug 7, 2025 Breach notices begin going out by mail. source
  3. Jun 3, 2026 Columbia says it has finished notifying the people potentially affected. source
  4. Sep 23, 2026 Preliminary approval of the $16,125,000 settlement; claims administration assigned to Angeion Group. source
  5. Oct 23, 2026 Columbia posts that it has reached a settlement and that the court-appointed administrator will handle claims. source

Documents

Other settlements we track

All class action settlements, how long payouts take and what changed lately