Columbia University $16.13 Million Data Breach Settlement

U.S. residents whose private information the May 2025 Columbia University cyberattack compromised and who received a notice about the incident may be eligible to claim up to $8,500 plus credit monitoring from a class action settlement.

Trustees of Columbia University in New York agreed to pay $16,125,000 to settle a class action lawsuit alleging the university failed to adequately protect sensitive personal information during a cyberattack. The potentially exposed information includes names, Social Security numbers, financial account details, medical and academic records, and other private data. The university estimates the settlement includes approximately 2,973,631 people.

Who can file a claim?

Class members are individuals residing in the United Staes whose private information the May 2025 Columbia University cyberattack compromised and who received a notice from Columbia University about the attack. The settlement class is closed; only those with a notice ID number and confirmation code from their settlement notice can submit a claim. Individuals who did not receive a notice are not eligible to file a claim.

How much can class members receive?

Eligible class members may claim the following benefits:

• Reimbursement for documented monetary losses: Class members can claim up to $8,500 for documented losses resulting from the cyberattack, such as costs related to identity theft, fraud, credit monitoring or other related expenses.
• Alternative cash payment: Class members who do not wish to claim documented losses can choose an alternative cash payment. The exact amount depends on the number of valid claims and the remaining settlement fund after deductions for attorneys’ fees, litigation expenses, service awards, administration costs, credit monitoring expenses and approved claims for documented losses.
• Credit monitoring and identity theft protection: All class members can claim two years of free three-bureau credit monitoring, dark web monitoring, identity theft insurance up to $1,000,000 and fully managed identity recovery services.

How to claim a settlement payment

To receive a settlement benefit, class members must submit an online claim form or print and complete the PDF claim form and mail it to the settlement administrator. Only those who received a notice with a unique notice ID number and confirmation code can submit a claim.

Settlement administrator's mailing address: Columbia University Data Settlement Administrator, 1650 Arch St., Suite 2210, Philadelphia, PA 19103

The deadline to submit a claim is Jan. 21, 2027.

Required documentation

• Reimbursement for documented monetary losses: Class members must provide receipts, statements or other non-self-prepared documents supporting their claimed losses and showing the information used to commit identity theft or fraud consisted of the same type of private information the cyberattack potentially exposed. The documentation must show the loss occurred on or after May 16, 2025. Class members cannot claim losses a third party already reimbursed.
• Alternative cash payment and credit monitoring: Class members do not need to provide documentation, but they must be a class member with a valid notice ID and confirmation code.

Payout options

• Zelle
• PayPal
• Venmo
• Physical check mailed to the address on the claim form

$16.13 million settlement fund breakdown

The $16,125,000 settlement fund includes:

• Settlement administration costs: Amount not specified
• Attorneys’ fees: Up to $4,031,250
• Attorneys' costs and expenses: Amount not specified
• Service awards to class representatives: $500 each ($9,000 total)
• Credit monitoring: Cost determined by number of claims filed
• Payments to eligible class members: Remainder of the fund

Important dates

• Deadline to opt out: Dec. 22, 2026
• Deadline to file a claim: Jan. 21, 2027
• Final approval hearing: Feb. 23, 2027

When is the Columbia University data breach payout date?

The settlement administrator will issue payments to eligible class members after the court resolves any appeals and grants final approval of the settlement.

Why did this class action settlement happen?

A cyberattack in May 2025 reportedly exposed sensitive personal information Columbia University maintained. The plaintiffs alleged the university failed to adequately protect private data, resulting in potential identity theft and other risks for affected individuals.

Columbia University denied any wrongdoing but agreed to settle to avoid the cost and uncertainty of ongoing litigation.

Sources

1. Claim form
2. Class notice
3. Settlement agreement
4. Settlement website FAQ page