Columbia University to pay $16.1M to settle cyberattack lawsuit
Hackers walked away with sensitive student data. Columbia University is now settling the bill.
Columbia university. By Shutterstock
Follow us
- Columbia University agreed to pay $16.1 million to settle a lawsuit over a 2025 cyberattack.
- The breach exposed data from more than 868,000 students, applicants, faculty, and former students.
- Stolen information included Social Security numbers, academic records, financial details, insurance data, and health information.
- Eligible victims may claim up to $8,500 if they can prove losses from the breach.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Columbia University has agreed to settle a class-action lawsuit regarding a major data breach for a total of $16.1 million.
In May 2025, an attacker exfiltrated the personal information of hundreds of thousands of people who either attempted to enroll at the university or studied there.
“Our investigation determined that, on or about May 16th, 2025, an unauthorized third party gained access to Columbia’s network and subsequently took certain files from our system,” the university said in a data breach notification addressed to the Maine Attorney General’s Office.
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
The notice revealed that the attack affected over 868,000 current and former students, faculty members, and applicants.
Attackers snagged personal details such as names, dates of birth, contact information, Social Security numbers, academic history, demographic information, financial and insurance-related information, and health information.
The data breach was revealed after a June technical outage, which knocked out several of the university’s systems.
Following the data breach, a class-action lawsuit was filed against Columbia University. The university has now decided to settle the case for $16.1 million.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Victims of the data breach can claim up to $8,500 in damages, provided they can substantiate their claims. They can also opt for an “alternate cash payment,” meaning that the money remaining after payments to attorneys and other victims is divided among the participants.
According to the settlement notice, which the court has preliminarily approved, Columbia University estimates that there are 2,973,631 settlement class members.
“We regret the concern that this incident has caused our community and believe the actions we have taken and commitments we have accepted in the agreement reflect the seriousness with which we are approaching this matter,” Columbia University says in a statement about the settlement.
