Columbia University Data Breach Class Action Settlement
The Trustees of Columbia University in the City of New York agreed to pay $16,125,000 to settle a class action over a May 2025 cyberattack that potentially exposed the personal, financial, health, and admissions information of about 2.97 million people. Class members can claim reimbursement of up to $8,500 for documented losses or a pro rata alternative cash payment, plus two years of three-bureau credit monitoring. The claim deadline is January 21, 2027.
Settlement fund
$16.1M
Common fund for about 2.97 million class members
Top payout
Up to $8,500
Documented losses, or a pro rata alternative cash payment
Claim deadline
Jan 21, 2027
78 days remaining
You may be owed money
Get claim instructions and more information directly from the official settlement website. Deadline: Jan 21, 2027.
Do you qualify?
You are a Class Member if ALL of the following apply:
- You are an individual residing in the United States whose Private Information was potentially accessed by unauthorized third parties in the May 2025 cyberattack on Columbia University, including anyone who was sent notice of it.
- The settlement covers approximately 2,973,631 class members.
- Excluded: Columbia and its parents, subsidiaries, affiliates, officers, directors, and controlled entities; Columbia's counsel and their immediate families; the judges assigned to the case and their immediate families; and anyone who timely opts out.
Not sure if you qualify? Call the Settlement Administrator toll-free at 1-833-617-4373, or get more information from the settlement website directly at ColumbiaUniversityDataSettlement.com.
What happened
This lawsuit, In re Columbia University Data Breach Litigation, arises from a May 2025 cyberattack in which an unauthorized third party accessed Columbia University systems. The plaintiffs claim the exposed information included names, dates of birth, addresses, contact details, demographic information, citizenship status, Social Security numbers, driver's license numbers, financial account information, medical and health insurance information, and academic, financial aid, and admissions records. They assert negligence, breach of implied contract, unjust enrichment, breach of bailment, declaratory judgment, and violations of several state consumer protection and privacy laws.
Columbia denies these allegations and denies any wrongdoing or liability, and the Court has not decided who is right. The parties agreed to settle to avoid the cost and risk of continued litigation. Columbia has also committed to maintain added security measures, including defensive tools and increased monitoring, for three years after the settlement takes effect.
How to file a claim
-
1. Confirm you are eligible
You are likely a class member if you reside in the United States and received notice that your information was potentially accessed in the May 2025 Columbia University cyberattack.
-
2. Choose your cash benefit
Choose either reimbursement of up to $8,500 for documented losses on or after May 16, 2025 that are fairly traceable to the cyberattack, or a pro rata Alternative Cash Payment from the remaining fund. If your documented loss award is less than the Alternative Cash Payment, you receive the larger amount. You can also elect two years of three-bureau credit monitoring.
-
3. Get the details from the settlement website
Get claim instructions and file through the official settlement website at ColumbiaUniversityDataSettlement.com by January 21, 2027, or mail a paper claim postmarked by that date to the Columbia University Data Settlement Administrator, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103.
-
4. Receive your payment
Payments are issued only after the Court grants final approval at the February 23, 2027 Final Approval Hearing and the settlement becomes final. You can choose an electronic payment or a paper check when you file.
Key dates
- Dec 22, 2026 Opt-out & objection deadline Upcoming
- Jan 21, 2027 Claim filing deadline Upcoming
- Feb 23, 2027 Final Fairness Hearing (2:00 p.m. ET, Courtroom 11D, 500 Pearl Street, New York, NY) Upcoming
- TBD after final approval Payments issued to claimants Pending
The Final Approval Hearing is scheduled for February 23, 2027 at 2:00 p.m. ET in Courtroom 11D of the Daniel Patrick Moynihan United States Courthouse, 500 Pearl Street, New York, NY, before the Honorable P. Kevin Castel. Exclusion requests and objections must be postmarked by December 22, 2026. The Court may move the hearing, so check ColumbiaUniversityDataSettlement.com for updates.
Where the money is going
Columbia agreed to pay $16,125,000 into a settlement fund. The fund pays documented loss reimbursements, credit monitoring, notice and administration costs, attorneys' fees and expenses, and service awards. The remaining amount is divided pro rata among class members who choose the Alternative Cash Payment.
All amounts above are maximums or requests and remain subject to Court approval at the February 23, 2027 Final Approval Hearing. The Court may award less than requested. The Notice does not estimate the Alternative Cash Payment, which depends on the number of valid claims and may be reduced pro rata.
Common questions
How much money will I receive?
You can claim reimbursement of up to $8,500 for documented losses, or a pro rata Alternative Cash Payment. The Notice does not estimate the cash amount, which depends on how many valid claims are filed and what remains after fees, costs, and other benefits. You can also elect two years of credit monitoring.
Do I need to submit proof of purchase?
Not for the Alternative Cash Payment or credit monitoring. Documented loss claims require supporting documentation, generally third-party records, and losses must have occurred on or after May 16, 2025. Self-prepared documents such as handwritten receipts are not enough on their own. Get claim instructions from the settlement website directly.
What if I didn’t receive a notice?
If you believe your information was involved but you did not receive a notice, get more information from the settlement website directly at ColumbiaUniversityDataSettlement.com or call the Settlement Administrator at 1-833-617-4373.
Does staying in the class affect my right to sue later?
Yes. Unless you exclude yourself by December 22, 2026, you will be bound by the settlement and give up the right to sue Columbia and other Released Parties over claims relating to the cyberattack, whether or not you file a claim. The full release is in Section XIII of the Settlement Agreement.
When will payments be sent out?
The Court will hold the Final Approval Hearing on February 23, 2027. Payments are made only after final approval and the settlement becomes final, which may take time if there are appeals. Check ColumbiaUniversityDataSettlement.com for updates.
Dapeer Law, P.A.
Consumer class action attorneys based in South Florida. We track settlements so you don’t have to.
Similar open settlements
This page is for informational purposes only and does not constitute legal advice. Dapeer Law, P.A. is not the administrator of this settlement and is not affiliated with The Trustees of Columbia University in the City of New York, Angeion Group (Columbia University Data Settlement Administrator) (the Settlement Administrator), or Class Counsel William B. Federman of Federman & Sherwood, Ashley M. Crooks of Hausfeld LLP, Rachele R. Byrd of Wolf Haldenstein Adler Freeman & Herz LLP, and Charles E. Schaffer of Levin Sedran & Berman, LLC. The case is In re Columbia University Data Breach Litigation, Case No. 1:25-cv-05541 (PKC), pending in the United States District Court for the Southern District of New York before the Honorable P. Kevin Castel. Class representatives are Khamari Babb, Raymond Chao, Steven Daley, Randall Erwin, David Guirgis, Alex Hall, Shakeem Holmes, Rema Khacho, Lauren Kramer, Luke Linich, Nadav Margalit, John McQueen, Liam Murray, Gabriela Nadeau, Joseph Quintero, Carrick Reider, Andrew Rudick, and Mary Thomas. Columbia University denies wrongdoing. This website is attorney advertising. Past results do not guarantee future outcomes.