Columbia University Settles Data Breach Lawsuit for $16.1 Million

Columbia University is accepting claims as part of a $16.1 million class action settlement following a cyberattack in June 2025. The breach affected approximately 3.1 million people, exposing sensitive information including Social Security numbers, medical records, academic histories, and financial-account information.

Eligible claimants have until January 21, 2027, to seek cash payments, identity-theft restoration services, and credit monitoring. The university stated that its investigation found the hacker's motivation was political rather than financial, and noted there was no evidence that the stolen data was sold or distributed on the dark web.

As part of the settlement agreement, which received preliminary court approval, the university committed to improving its data governance practices and enhancing its cybersecurity program. The court appointed the Angeion Group, LLC, as the independent third party to manage the claims process.