Columbia Settlement Opens Claims for Breach Victims
Columbia University's $16.1 million class action settlement over a 2025 cyber attack now accepts claims through January 21, 2027.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Do you trust large institutions to protect your personal data?
Columbia University opened claims for a $16.1 million class action settlement stemming from a cyber attack discovered in June 2025. The university now counts roughly 3.1 million affected people, up from about 870,000 in an earlier count cited in a May filing with state officials.
Why it matters
The breach exposed Social Security numbers, addresses, financial-account information, academic histories and medical information, and the settlement is the university's agreement to resolve litigation brought on behalf of people who may have been affected. For New York City residents connected to the university, the claims process is the main avenue for recovering costs tied to the exposure.
The university's affected-person count of roughly 3.1 million is more than three times the earlier figure of about 870,000 cited in a May filing with state officials. The settlement totals $16.1 million, but the source does not say how that amount will be distributed among claimants.
The players
Columbia University
A private Ivy League research university in New York City whose 2025 cyber attack exposed sensitive personal data of affected individuals.
Angeion Group
An independent claims administration firm appointed by the court to manage claims in the Columbia University settlement.
The details
Columbia discovered the cyber attack in June 2025, and the compromised data included Social Security numbers, addresses, demographic details, financial-account information, academic histories and medical information. Angeion Group, an independent third party appointed by the court, is managing claims, and affected people can file using instructions sent to them, with possible benefits including credit monitoring, identity theft recovery help and cash payments.
Timeline
June 2025: Columbia discovers the cyber attack.
September 2025: Columbia agrees to the settlement.
May 2026: A filing with state officials cites an affected count of about 870,000.
October 23, 2026: Columbia issues an update on the settlement agreement.
January 21, 2027: Deadline to file settlement claims.
Big Picture
Large university data breaches have increasingly been resolved through court-supervised class action settlements that use independent claims administrators, and Columbia's $16.1 million agreement follows that pattern. The jump from roughly 870,000 to 3.1 million affected people shows how breach counts can expand well after an initial disclosure.
Affected people can file claims through Angeion Group using the instructions sent to them, and possible benefits include credit monitoring, identity theft recovery help and cash payments. Anyone who may have been exposed should watch for those instructions and act before the January 21, 2027 deadline.
The takeaway
If you were affected by the Columbia breach, check for the claim instructions sent to you and file before January 21, 2027. Keep an eye on your financial accounts and credit reports in the meantime, since the exposed data included Social Security numbers and financial-account information.
What happens next
The claims deadline for the Columbia University settlement is January 21, 2027.
Further reading
For related coverage, see Cybersecurity news in New York City.
More information
Find claim details on the Angeion claims and settlement information site.
Live Poll
Do you trust large institutions to protect your personal data?
