Columbia University Data Breach Settlement: $16.12M+ Deal Wraps Up Class Action Lawsuit Over 2025 Cyberattack

New to ClassAction.org? Read our Newswire Disclaimer

Columbia University has agreed to a $16,125,000 data breach settlement to wrap up a class action lawsuit that alleged the Ivy League university failed to adequately safeguard certain sensitive information from a May 2025 cyberattack.

Get class action lawsuit and class action settlement news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter.

The Columbia University data breach settlement received preliminary approval from the court on September 23, 2026. Eligible for the settlement are all United States residents whose private information was potentially accessed by one or more unauthorized third parties during the May 2025 Columbia University data breach, including all who were sent notice of the Columbia hack.

Court documents state that an estimated 2,973,631 people are included in the settlement class.

The court-authorized Columbia University data breach settlement website can be found at ColumbiaUniversityDataSettlement.com.

Class members who file a timely, valid claim form can receive up to $8,500 for documented, unreimbursed out-of-pocket losses incurred due to the data breach. This benefit covers losses from identity theft or fraud and costs for credit monitoring, long-distance phone calls, postage, mileage, and more.

Class members must submit proof, such as receipts, to receive a documented-loss payment.

In lieu of a documented-loss payment, class members can file a claim form to receive a pro rata (proportional) cash payment, with no proof required.

Lastly, all class members can elect on their claim form to receive two years of three-bureau credit monitoring, which includes dark web monitoring, identity recovery services, and identity theft insurance.

To file a Columbia University data breach settlement claim form online, class members can visit this page and enter the notice ID and confirmation code found on their copy of the settlement notice. Alternatively, class members can download a PDF claim form to print, complete, and return by mail to the settlement administrator.

All Columbia University settlement claim forms must be filed online or postmarked by January 21, 2027.

The court will determine whether to grant final approval to the Columbia University class action settlement following a hearing on February 23, 2027. Data breach settlement benefits will begin to be made available to class members only after final approval has been granted and any appeals have been resolved.

The Columbia University class action lawsuit alleged that the New York City institution of higher education failed to implement adequate cybersecurity measures to protect the private information of employees, students, student applicants, and alumni from a data breach that occurred in or around May 2025.

Court documents state that the personal information that may have been compromised during the cyberattack included names, addresses, Social Security numbers, driver’s license numbers, financial account information, medical information, health insurance information, dates of birth, contact details, demographic information, gender, ethnicity, citizenship status, academic history, financial aid information, test scores, academic grades, admission decisions, expected graduation dates, financial aid status, financial aid awards, and tuition information.

Check out ClassAction.org’s lawsuit list for the latest open class action lawsuits and investigations.