Columbia University data breach settlement
In re Columbia University Data Breach Litigation
Also known as Columbia data breach; Columbia cyberattack; Trustees of Columbia University
The lawsuit said a May 2025 cyberattack exposed data Columbia held, including SSNs and financial aid details.
Copied from the official notice. Last compared Nov 7, 2026.
- You could get
- A share of the fund $16.125 million fund, split among everyone who files. Or up to $8,500 for losses you can show with paperwork.
Source
“The amount shall be determined by distributing the remaining Settlement Fund”
From the administrator site: Official long-form notice (PDF on official site). Last compared Nov 7, 2026.
- You need
- No receipt needed Needs the code from your notice Notice ID Number from the notice you got by email or mail Some paperwork: describes the claim form only
Source
“This is a closed class and the benefits described herein are available only to Settlement Class Members with a unique Notice ID Number.”
From the administrator site: Official long-form notice (PDF on official site). Last compared Nov 7, 2026.
- Who can file
- Data potentially accessed in Columbia's May 2025 cyberattack
Source
“You are part of the Settlement Class if you are an individual residing in the United States whose Private Information was potentially accessed by one or more unauthorized third parties during the Cyberattack including if you were sent notice of the Cyberattack. ... Excluded from the Settlement Class are (a) Defendant and Defendant’s parents, subsidiaries, affiliates, officers and directors, and any entity in which Defendant has a controlling interest; (b) all individuals who make a timely election to be excluded from this proceeding using the correct protocol for opting out; (c) Defendant’s Counsel, as well as their ... immediate family members; and (d) all judges assigned to hear any aspect of this litigation, as well as their immediate family members.”
From the administrator site: Official long-form notice (PDF on official site). Last compared Nov 7, 2026.
- Where
- Anywhere in the U.S.
Source
“All individuals residing within the United States whose Private Information was potentially accessed by one or more unauthorized third parties during the Cyberattack, including all who were sent notice of the Cyberattack.”
From the court record: Preliminary approval order (court order, PDF on official site). Last compared Nov 7, 2026.
- Time to file
- About 4 minutes
Source
Our estimate of how long the official claim form takes. The notice does not say.
From the official site: columbiauniversitydatasettlement.com. Last compared Nov 7, 2026.
Free. The official site never charges.
Quick answers
How much is the Columbia University data breach settlement payout?
A share of the fund. $16.125 million fund, split among everyone who files. Or up to $8,500 for losses you can show with paperwork.
Where is the Columbia University data breach settlement claim form?
On the official site, columbiauniversitydatasettlement.com. Filing is free. The last day to file is Jan 21, 2027.
When will the Columbia University data breach settlement pay?
Payment can only happen after the court gives final approval and any appeals are over.
The final approval hearing is set for Feb 23, 2027.
Is the Columbia University data breach settlement legit?
The settlement administrator (the company that handles claims) is Angeion, and the official site is columbiauniversitydatasettlement.com. Real notices point there; if a link in a message goes anywhere else, do not use it.
The official site never asks you to pay to file.
Compare yourself to the official class definition
You may be included if you live in the U.S. and your data may have been accessed in Columbia University's May 2025 cyberattack.
It covers people sent notice of the cyberattack; benefits go only to class members with a Notice ID from their notice.
You are not included if you are a Columbia officer or director, its lawyers, a judge on the case, or a lawyer's or judge's immediate family.
Check each condition yourself. The boxes are only for you; nothing is sent or stored.
All individuals residing within the United States whose Private Information was potentially accessed by one or more unauthorized third parties during the Cyberattack, including all who were sent notice of the Cyberattack.
From the court record: Preliminary approval order (court order, PDF on official site)
This checklist is for guidance only and can be wrong. Only the court's definition decides. Read the official wording before you file.
How to file
-
Find the code from your notice
- Notice ID Number from the notice you got by email or mail
-
Gather what you need
No proof of purchase is required.
- For documented losses: a bank or card statement or other proof that you did not prepare yourself
- PayPal, Venmo or Zelle details, or a mailing address for a check
-
File online, or by mail
At columbiauniversitydatasettlement.com, by Jan 21, 2027. Filing is free.
Or mail a paper claim form to:Columbia University Data Settlement Administrator, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103
The deadline note says: “Online by January 21, 2027, or by mail postmarked by January 21, 2027.” -
Save your confirmation
Keep your confirmation number or email. You do not need to file again.
Confirm with the administrator before you act.
After you file
Payment can only happen after the court gives final approval and any appeals are over.
The final approval hearing is set for Feb 23, 2027.
For context: First payments were issued 52 to 875 days after final approval, based on 15 settlements. Half were paid within 119 days. 1 of the 15 waited on appeals after approval.
Also ending this week
Related settlements
Case details
- Case
- In re Columbia University Data Breach Litigation
- Court
- United States District Court for the Southern District of New York
- Case number
- 1:25-cv-05541 (PKC)
- Administrator
- Angeion
- Official site
- columbiauniversitydatasettlement.com
- Settlement fund
- $16,125,000
- Full payout terms
- Cash share, or up to $8,500 for documented lossesEither reimbursement of documented monetary losses up to $8,500 (documents required), or an Alternative Cash Payment whose amount is the remaining Settlement Fund divided among claimants after fees, costs, credit monitoring and loss claims (no amount published). Everyone who files may also choose two years of three-bureau credit monitoring with $1,000,000 identity theft insurance.
- Effort
- Easy, about 4 minutes
Other dates
- Opt-out (exclusion) deadline
- (ahead) source document
- Objection deadline
- (ahead) source document
- Final approval hearing
- (ahead) source document
The court’s exact words
All individuals residing within the United States whose Private Information was potentially accessed by one or more unauthorized third parties during the Cyberattack, including all who were sent notice of the Cyberattack.
Quoted from the official notice. Read the notice for the full definition.
Our notes: The settlement concerns a May 2025 cyberattack on Trustees of Columbia University in the City of New York in which an unauthorized third party accessed information including names, dates of birth, Social Security numbers, financial account and financial aid information, and academic records. Per the court order and notice, the class is individuals residing in the United States whose Private Information was potentially accessed in the Cyberattack, including all who were sent notice (Columbia estimates 2,973,631 class members). The notice says this is a closed class and benefits are available only to class members with a unique Notice ID Number. Excluded: Columbia and its parents, subsidiaries, affiliates, officers and directors; people who opt out; Columbia's counsel and their immediate families; and judges on the case and their immediate families. Read the notice for the full definition.
Sources and checks (4)
Every fact people act on was copied from the official source and compared with it. How we check
- Official long-form notice (PDF on official site) administrator site
- Official claim form (PDF on official site) administrator site
- Preliminary approval order (court order, PDF on official site) court record
- Official settlement website home page administrator site
What changedLast change Oct 26, 2026
- Page created. Claims open until January 21, 2027. source document
Questions
I already filed. What now?
Keep your confirmation number or email. You do not need to file again. Payment can only happen after the court gives final approval; once it does, the payment status page shows what is known.
Opting out
To leave the settlement and keep your right to sue on your own, follow the official notice by Dec 22, 2026. If you opt out, you get no payment. Opting out and objecting have separate rules; we cannot tell you which is right for you.