Columbia University Health Care $600K Data Breach Settlement

Individuals who received a notification from Columbia University Health Care Inc. stating a data breach that occurred between Sept. 11, 2023, and March 7, 2024, could have affected their private information may qualify to claim $10,000 or more plus two years of credit monitoring from a class action settlement.

Columbia University Health Care Inc. agreed to pay $600,000 to settle a class action lawsuit alleging it failed to implement and maintain reasonable security measures to protect private information, resulting in a data incident that potentially exposed sensitive data.

Who can file a claim?

Class members are U.S. residents who received a double-sided postcard from Columbia University Health Care Inc. stating a data incident that occurred between Sept. 11, 2023, and March 7, 2024, may have impacted their private information.

How much can class members receive?

• Reimbursement for documented losses: Up to $10,000 per person. Documented losses may include:
• Bank fees
• Postage
• Gasoline for local travel
• Fees for credit reports, credit monitoring or identity theft insurance products purchased between Dec. 21, 2023, and Nov. 25, 2025

• Pro rata cash payment: Calculated based on the remaining funds after the settlement administrator distributes all other payments, including settlement administration costs, attorneys' fees and expenses and service awards to class representatives.
• Credit monitoring: Two years of CyEx Medical Shield Complete credit and medical monitoring services, which includes:
• One-bureau credit monitoring
• Health insurance plan ID monitoring
• Medicare beneficiary monitoring
• Medical record number monitoring
• Dark web monitoring
• Health savings account monitoring
• National provider identifier monitoring
• High-risk transaction monitoring
• Security freeze assistance
• Victim assistance

If the total amount of valid claims exceeds the net settlement fund, the settlement administrator may reduce payments and benefits on a pro rata basis.

How to claim a class action payment

Class members can submit the online claim form or download, print, complete and mail the PDF claim form to the settlement administrator. The deadline to submit a claim is Nov. 25, 2025.

Settlement administrator's mailing address: Columbia Data Incident Settlement Administrator, P.O. Box 4118, Portland, OR 97208-4118

What proof or documentation is required to submit a claim?

• All class members must provide the unique ID and PIN from their settlement notice located on the inside of the perforated double postcard at the top of the page. Those who didn’t receive or lost their notice should contact the settlement administrator at 1-888-887-7407 or info@ColumbiaHealthCareDataBreach.com.
• To claim documented losses, class members must provide documentation, such as receipts, account statements or other evidence of costs and a description of how the loss is related to the data incident. Self-prepared documents, such as handwritten receipts, are not sufficient on their own but may be used to clarify other documentation.

Payout options

• Electronic payment (selected after claim approval via email from Epiq)
• Paper check (default payment option)
• Credit monitoring activation code (if selected)

$600,000 settlement fund breakdown

The $600,000 settlement fund covers:

• Settlement administration costs: To be determined
• Attorneys' fees: Up to $200,000
• Attorneys' expenses: Up to $25,000
• Service awards to class representatives: $2,500 each for two representatives ($5,000 total)
• Credit monitoring costs: Dependent on number of valid claims
• Payments to eligible class members: Remainder of the fund

Important dates

• Deadline for exclusion: Oct. 27, 2025
• Deadline to file a claim: Nov. 25, 2025
• Final approval hearing: Dec. 5, 2025

When is the Columbia University Health Care Inc. settlement payout date?

The settlement administrator will send credit monitoring activation codes approximately 50 days after the court grants final approval and resolves any appeals. It will distribute payments after the court grants final approval and resolves any appeals.

Why did this class action settlement happen?

The class action lawsuit alleged Columbia University Health Care Inc. failed to implement adequate security measures to protect private information, resulting in a data incident that potentially exposed sensitive data.

Columbia denies any wrongdoing but agreed to settle to avoid the uncertainty, risks and expense of ongoing litigation.

Sources

1. Class notice.pdf)
2. Settlement agreement
3. Claim form
4. Settlement FAQ