People whose personal information was exposed in the 2025 cyberattack on Columbia University may qualify for about $100 in cash or up to $8,500 in documented losses, plus two years of credit monitoring, from the $16.1 million Columbia University data breach class action settlement. A federal judge granted preliminary approval on September 23, 2026, but the claim period has not opened yet.
Current Status
Claims are not open yet. Judge P. Kevin Castel of the U.S. District Court for the Southern District of New York granted preliminary approval on September 23, 2026, and set the final approval hearing for February 23, 2027. As of October 3, 2026, no official settlement website, claim form or claim deadline had been published. Class members are expected to receive notice explaining how and when to file.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
On September 18, 2026, the plaintiffs filed an unopposed motion for preliminary approval of a $16.1 million settlement with the Trustees of Columbia University in the City of New York. On September 23, Judge Castel issued an opinion saying the motion would be granted and entered a separate order granting it the same day.The judge also ordered changes to the proposed class notice. He struck eight of the thirteen conditions the draft notice placed on anyone wanting to object, including requirements to list past objections and to disclose whether artificial intelligence was used to write the objection, finding they would “needlessly frustrate and discourage objections.” He also struck the warning that missing any condition would forfeit the right to object.
The settlement resolves In re Columbia University Data Breach Litigation, No. 1:25-cv-05541, which combined ten lawsuits filed in July and August 2025 after Columbia disclosed the cyberattack. The plaintiffs allege that Columbia negligently failed to protect personal information with cybersecurity measures suited to the sensitivity of the records. The allegations have not been proven in court. Columbia also agreed to fund changes to its security practices, according to the Spectator, which reported that the specific measures were not detailed.
Who Qualifies?
The settlement is expected to cover people whose personal information was involved in the 2025 cyberattack on Columbia’s systems. Columbia reported to the Maine Attorney General’s office that 868,969 people were affected, and it mailed notification letters in August 2025. Those affected include applicants and prospective students, current and former students, employees and other university affiliates, as well as some people with no Columbia affiliation.Exposed information varied by person and included names, contact details, dates of birth, Social Security numbers, application and academic records, financial aid information, and insurance and health information. The exact class definition is in the settlement agreement filed with the court, which OCA has not been able to review; this page will be updated once the official notice is published.
How Much Can You Get?
According to the settlement motion as reported by the Columbia Daily Spectator and Bloomberg Law, the $16.1 million fund provides each class member who files a valid claim with a choice of:- Documented losses: reimbursement of out-of-pocket costs tied to the breach, up to $8,500 per person, with documentation; or
- Alternative cash: a payment estimated at about $100 per person, with no documentation of losses.
This is separate from the two years of Kroll credit monitoring Columbia offered on its own after the breach. In a January statement, the university said there was no evidence of identity theft or fraud.
What Proof or Notice ID Is Required?
The claim form has not been released. Claims for documented losses will require records of the out-of-pocket costs. Whether the alternative cash claim will require a notice ID or other identifier from Columbia’s notice will be clear once the form is published.What Is the Deadline?
No claim, opt-out or objection deadline has been announced yet. Those dates will be set out in the class notice. The final approval hearing is scheduled for February 23, 2027 at 2 p.m.How Do You Take Action?
There is nothing to file yet. When the claim period opens, the official notice and settlement website will explain how to submit a claim online or by mail. OCA could not locate an official settlement website as of October 3, 2026, and will add the link here when one is published. Any website or message asking for payment to join the Columbia settlement is not part of the court process.What Happens Next?
Notice goes out to class members under the court-approved plan, the claim period opens, and Judge Castel will hold the final approval hearing on February 23, 2027 at 2 p.m. at the Daniel Patrick Moynihan U.S. Courthouse in Manhattan. Payments and credit monitoring would follow only after final approval and the resolution of any appeals.Sources and Verification
- In re Columbia University Data Breach Litigation, No. 1:25-cv-05541 (S.D.N.Y.) — CourtListener docket, including the September 18, 2026 motion for preliminary approval (ECF 58) and the order granting it (ECF 60)
- Opinion and Order (ECF 59, September 23, 2026), granting preliminary approval with changes to the class notice and setting the final approval hearing
- Columbia Daily Spectator, “Columbia to settle June 2025 data breach lawsuit for $16.1 million” (September 21, 2026)
- Bloomberg Law, “Columbia University Agrees to $16 Million Data Breach Settlement”
OpenClassActions.com is a consumer news site and is not the settlement administrator or a law firm.
Questions
Can I file a claim in the Columbia data breach settlement yet?
Not yet. The judge granted preliminary approval on September 23, 2026, but as of October 3, 2026 no official settlement website, claim form or claim deadline had been published. Notice to class members comes next, and it will explain how and when to file.
How much could Columbia data breach class members get?
According to the September 18, 2026 settlement motion as reported by the Columbia Daily Spectator and Bloomberg Law, class members can claim reimbursement of documented out-of-pocket losses of up to $8,500, or an alternative cash payment of about $100, plus two years of credit monitoring and identity theft protection. The $100 figure is an estimate and can change with the number of claims.
I already got free credit monitoring from Columbia. Is this the same thing?
No. After the breach, Columbia offered affected people two years of credit monitoring through Kroll on its own. The settlement provides a separate two years of monitoring, along with the cash benefits, to class members who file valid claims once the claim period opens.
Is this the same as the $600,000 Columbia University Irving Medical Center settlement?
No. That earlier state-court case, Nemeth v. Columbia University Health Care, covered about 29,000 patients whose lab data was exposed on a third-party website. It received final approval in December 2025, and its claim deadline has passed. The $16.1 million settlement covers the separate 2025 cyberattack on the university.
When is the final approval hearing?
Judge P. Kevin Castel set the final approval hearing for February 23, 2027 at 2 p.m. at the Daniel Patrick Moynihan U.S. Courthouse in Manhattan. Payments would not be made until after final approval.
