Columbia University to pay $16.1M to settle cyberattack lawsuit

Columbia University has agreed to pay $16.1 million to settle a class-action lawsuit over a 2025 cyberattack that exposed personal information from more than 868,000 people. The breach affected current and former students, faculty members, and applicants, and stolen data included Social Security numbers, academic records, financial details, insurance data, and health information. Eligible victims may claim up to $8,500 if they can substantiate losses from the incident.

What happened

According to a data breach notification addressed to the Maine Attorney General's Office, an unauthorized third party gained access to Columbia's network on or about May 16, 2025, and took certain files from its system. The attack affected over 868,000 current and former students, faculty members, and applicants. Stolen information included names, dates of birth, contact information, Social Security numbers, academic history, demographic information, financial and insurance-related information, and health information. The breach was revealed after a June technical outage that knocked out several of the university's systems. Following the breach, a class-action lawsuit was filed against Columbia University.

Settlement and claims

Columbia University has now decided to settle the case for $16.1 million. The settlement notice, which the court has preliminarily approved, estimates that there are 2,973,631 settlement class members. Victims can claim up to $8,500 in damages, provided they can substantiate their claims. They can also opt for an alternate cash payment, meaning that money remaining after payments to attorneys and other victims is divided among participants. Columbia University said it regrets the concern the incident caused its community and believes the actions and commitments in the agreement reflect the seriousness with which it is approaching the matter.

Sources: Cybernews