Columbia Opens Claims for $16 Million Data Breach Settlement

Columbia University has opened the window for individuals impacted by the school’s data breach last year to claim part of a $16.1 million settlement.

The university agreed in September to settle a proposed class action over the incident, with affected individuals eligible for credit monitoring, identity-theft restoration services and cash payments. Claims are due Jan. 21, 2027, according to a notification sent to people affected by the breach.

The settlement stems from a cybersecurity incident first reported by Bloomberg that exposed information belonging to millions of people, including university applicants. The compromised data included Social Security numbers, addresses, demographic information, financial-account details, academic histories and medical information, according to the notification.

The Manhattan-based university tallies roughly 3.1 million individuals affected by the breach, up from last year’s count of about 870,000 individuals, according to information filed with state officials in May. A Columbia official said in August the “data types affected during this incident differed for each individual, so that not every type of data was necessarily affected for every person.”

The university said Friday it had found no evidence the cyber-attack was financially motivated or that the data was sold or distributed on the dark web.

After Columbia discovered the incident in June 2025, hackers continued to strike the university’s Ivy League peers through the end of the year, leaving behind a trail of data breaches.

A data breach at the University of Pennsylvania affected 440,000 individuals and another at Dartmouth College affected 99,000 individuals, according to data from the Texas Attorney General. The universities’ reports to state officials indicate the breaches contained Social Security numbers and financial information.