Columbia University agrees to $16.1 million settlement over 2025 data breach

Columbia University Has agreed to pay $16.1 million to settle a class action lawsuit over a 2025 data breach that impacted nearly 900,000 people.

 

In August 2025, Columbia University said that it experienced a cyber security incident after an unauthorised actor gained access to parts of its network. According to a filing with the Maine state regulator, the breach, which occurred on May 16, 2025, exposed sensitive personal information belonging to 868,969 people. 

 

The compromised data varied by person but included names, dates of birth, Social Security numbers, data regarding application to Columbia, contact details, demographic information, academic history, insurance-related information and health information.

 

Following the cyberattack, a class action lawsuit was filed in the U.S. District Court for the Southern District of New York. Fifteen plaintiffs alleged that Columbia University failed to take reasonable steps to protect their personal information and did not implement adequate cybersecurity measures, which they claim contributed to the data breach.

 

While Columbia University denied any wrongdoing or negligence, both sides agreed to settle the case to avoid the costs and risks of continued litigation and allow Class members to receive benefits under the settlement.

 

As part of the settlement, Columbia University will create a $16.1 million settlement fund to pay eligible claims submitted by class members, in addition to covering settlement administration expenses, attorneys’ fees and costs, and any court-approved service awards.

 

Under the settlement, eligible class members who file a valid and timely claim will receive two years of free credit monitoring and identity theft protection services to help detect suspicious activity and protect their personal information.

 

The settlement also provides eligible individuals with the opportunity to receive cash compensation of up to $8,500 per person for documented out-of-pocket expenses and financial losses that can be reasonably traced to the data breach. Individuals who are unable to provide documentation for their losses may instead be eligible to receive an alternative cash payment option, subject to the terms, conditions, and eligibility requirements outlined in the settlement agreement.

 

The proposed settlement has been granted preliminary approval by the court but has not yet become final. A final approval hearing is scheduled for a later date, when the court will decide whether to approve the settlement.