Columbia University Data Breach Settlement
By the Class Action Buddy Editorial Team · Last reviewed November 3, 2026
Columbia University was breached in May 2025. An unauthorized third party reached private information the university held, and the Trustees of Columbia University in the City of New York have agreed to a $16,125,000 settlement without conceding that anything was done wrong.
The class is people in the United States whose information was caught in the attack and who were sent notice of it. The notice is the practical test, as it usually is with these.
What sets this one apart is that you are not forced to choose between cash and protection. Most breach settlements make you pick one. Here you take either reimbursement for documented losses, capped at $8,500, or an alternative cash payment from whatever remains in the fund — and then you can also take the credit monitoring on top.
That monitoring is better than the usual token offering: two years of three-bureau coverage, dark web monitoring, fully managed identity recovery, and identity theft insurance up to $1,000,000. If you were going to pay for a service like that anyway, it is worth more than most residual cash payments in these cases.
Columbia has also committed to keeping its additional security measures in place for three years after the settlement takes effect, which is a term you see less often than you might expect.
The dates run in an order that catches people out. The deadline to exclude yourself or object is December 22, 2026, but the claim deadline is a month later on January 21, 2027. Final approval is set for February 23, 2027 in the Southern District of New York.
Not sure if this settlement applies to you?
Take our 60-second eligibility quiz to find every settlement you qualify for — including this one.
Who Is Eligible?
You may be eligible to file a claim if you:
- You live in the United States and were sent notice that your private information was compromised in the May 2025 cyberattack on Columbia.
- The notice is the test. The class is defined by the people Columbia told, so the mailing is effectively the membership list.
- The defendant is the Trustees of Columbia University in the City of New York, and it denies any wrongdoing. No court has decided the question.
How Much Can You Get?
You pick one cash option, then add the monitoring on top. Most breach settlements force a choice between the two. This one does not.
Either reimbursement for documented losses up to $8,500, with paperwork tying the loss to the breach, or an alternative cash payment drawn from what remains of the $16,125,000 fund after fees, service awards, administration and the documented claims are paid.
And two years of credit monitoring either way: three-bureau coverage, dark web monitoring, fully managed identity recovery, and identity theft insurance up to $1,000,000. Priced on the open market that is worth more than most residual cash payments in cases like this.
Columbia has also committed to keeping its added security measures for three years after the settlement takes effect.
How to File Your Claim
File with the administrator:
- File by January 21, 2027 at columbiauniversitydatasettlement.com.
- Elect the credit monitoring on the same form. It is additional to the cash, not an alternative to it.
- Opting out or objecting closes earlier — December 22, 2026. That is a month before the claim deadline, so it is possible to lose the right to leave while still having time to file.
- Final approval is February 23, 2027 before the United States District Court for the Southern District of New York. The case is In re Columbia University Data Breach Litigation, No. 1:25-cv-05541 (PKC).
File this one with the administrator
Class Action Buddy does not file this settlement for you — use the official claim process above. What the app does do is watch the open settlements list and tell you when a new one matches your profile.
Frequently Asked Questions
What is the deadline to file a claim for the Columbia University Data Breach Settlement?
The current deadline to file a claim is Jan 21, 2027. Claims sent by mail must be postmarked by this date, so allow about a week for delivery if you are not filing online.
How do I file a claim for the Columbia University Data Breach Settlement?
File directly with the settlement administrator, using the official claim form linked on this page. Class Action Buddy does not support this settlement in the app, so the administrator’s own claim process is the route. You do not need a Claimant ID or PIN to file.
Do I have to choose between the cash and the credit monitoring?
No, and that is unusual. You choose between documented losses and the alternative cash payment, but the two years of credit monitoring is available in addition to whichever you pick.
How much is the alternative cash payment?
It is not fixed. It is whatever remains of the $16,125,000 after attorneys’ fees, service awards, administration costs, the credit monitoring and the documented-loss claims, divided among those who elect it. Turnout sets the figure.
I never received a notice. Am I covered?
Probably not. The class is people who were sent notice of the May 2025 cyberattack. If you believe you were affected but heard nothing, contact the administrator rather than filing a claim you cannot support.
Primary source: official settlement administrator — columbiauniversitydatasettlement.com. The settlement details on this page were checked against the administrator’s official website.
Class Action Buddy is an independent directory and is not affiliated with, endorsed by, or sponsored by the settlement administrator or the court. This page is general information, not legal advice. See how we verify settlements.
Ready to File Your Claim?
We're adding new settlements regularly. Download the app to get notified when this one is available.
Download Class Action Buddy →Get Notified About New Settlements
We find new class action settlements every week. Get alerts so you never miss free money.
No spam. Unsubscribe anytime. We respect your privacy.