People in the United States who were sent notice that their information was compromised in the May 2025 cyberattack on Columbia University may qualify to claim up to $8,500 in documented losses or an alternative cash payment, plus two years of credit monitoring, from the $16.1 million Columbia University data breach class action settlement. Claims close January 21, 2027, and a Notice ID from the notice is required.
Current Status
Claims are open. The official settlement website, ColumbiaUniversityDataSettlement.com, is accepting claims, which must be submitted online or postmarked by January 21, 2027. Judge P. Kevin Castel of the U.S. District Court for the Southern District of New York granted preliminary approval on September 23, 2026, and the final approval hearing is set for February 23, 2027. No payment date had been announced as of October 29, 2026.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
The claim period has opened. The court-approved notice and claim form are now posted on the official settlement website, setting January 21, 2027 as the claim deadline and December 22, 2026 as the deadline to opt out or object.The settlement resolves In re Columbia University Data Breach Litigation, No. 1:25-cv-05541, which combined ten lawsuits filed in July and August 2025 after Columbia disclosed the cyberattack. The plaintiffs allege that Columbia negligently failed to protect personal information with cybersecurity measures suited to the sensitivity of the records. Columbia denies any wrongdoing or liability, and the allegations have not been proven in court. When granting preliminary approval on September 23, Judge Castel struck eight of the thirteen conditions the draft notice placed on objectors, finding they would “needlessly frustrate and discourage objections.”
Who Qualifies?
The settlement class is individuals residing in the United States whose private information was compromised in the May 2025 cyberattack on Columbia and who were sent notice of the cyberattack. The notice describes it as a closed class: benefits go only to class members with a unique Notice ID, and claims from anyone else will be rejected.Columbia reported to the Maine Attorney General’s office that 868,969 people were affected and mailed notification letters in August 2025. Those affected include applicants and prospective students, current and former students, employees and other university affiliates. Exposed information varied by person and included names, contact details, dates of birth, Social Security numbers, application and academic records, financial aid information, and insurance and health information.
How Much Can You Get?
Each class member who files a valid claim chooses one of two cash options:- Documented losses: reimbursement up to $8,500 for losses incurred as a result of the cyberattack, with supporting documentation; or
- Alternative cash payment: a share of what remains in the $16,125,000 fund after court-approved attorneys’ fees and expenses, service awards, administration costs, credit monitoring and approved documented-loss claims.
On top of either cash option, a class member may elect two years of three-bureau credit monitoring with dark web monitoring, up to $1 million of identity theft insurance and identity recovery services. This is separate from the two years of Kroll monitoring Columbia offered on its own after the breach. Columbia also committed to keep its added security measures in place for three years after the settlement takes effect.
What Proof or Notice ID Is Required?
Every claim requires the unique Notice ID from the notice sent to class members. The documented-loss option also requires supporting records not prepared by the claimant, such as receipts or statements, and expenses that were already reimbursed are not covered. The alternative cash payment requires no documentation of losses.What Is the Deadline?
Claims must be submitted online or postmarked by January 21, 2027. Requests for exclusion and objections must be postmarked by December 22, 2026. The notice gives the claim deadline without a time of day.How Do You Take Action?
Claims are filed through the official settlement website, ColumbiaUniversityDataSettlement.com, or on a paper claim form printed from the site and mailed to the settlement administrator. The notice says filing online is the quickest route. The claim process is free; any website or message asking for payment to join the Columbia settlement is not part of the court process.What Happens Next?
The opt-out and objection deadline is December 22, 2026, and the claim deadline is January 21, 2027. Judge Castel will hold the final approval hearing on February 23, 2027 at 2:00 p.m. ET at the Daniel Patrick Moynihan U.S. Courthouse in Manhattan, where he will also consider class counsel’s fee request. Payments and credit monitoring follow only after final approval and the resolution of any appeals.Sources and Verification
- Official settlement website — ColumbiaUniversityDataSettlement.com
- Long Form Notice (PDF) — class definition, benefits, deadlines and final approval hearing
- In re Columbia University Data Breach Litigation, No. 1:25-cv-05541 (S.D.N.Y.) — CourtListener docket, including the motion for preliminary approval (ECF 58) and the order granting it (ECF 60)
- Opinion and Order (ECF 59, September 23, 2026)
- Columbia Daily Spectator, “Columbia to settle June 2025 data breach lawsuit for $16.1 million” (September 21, 2026)
- Bloomberg Law, “Columbia University Agrees to $16 Million Data Breach Settlement”
OpenClassActions.com is a consumer news site and is not the settlement administrator or a law firm.
Questions
Who can file a claim in the Columbia data breach settlement?
The settlement class is individuals residing in the United States whose private information was compromised in the May 2025 cyberattack on Columbia University and who were sent notice of it. The notice calls it a closed class: benefits are available only to class members with a unique Notice ID, and claims from anyone else will be rejected.
How much could Columbia data breach class members get?
Each class member chooses either reimbursement of documented losses up to $8,500 or an alternative cash payment. The alternative cash payment is a share of what remains in the $16,125,000 fund after fees, costs, credit monitoring and documented-loss claims; news reports on the settlement motion estimated it at about $100. Either choice can be combined with two years of credit monitoring and identity theft protection.
I already got free credit monitoring from Columbia. Is this the same thing?
No. After the breach, Columbia offered affected people two years of credit monitoring through Kroll on its own. The settlement offers a separate two years of three-bureau monitoring, with dark web monitoring, up to $1 million of identity theft insurance and identity recovery services, to class members who elect it on a valid claim.
Is this the same as the $600,000 Columbia University Irving Medical Center settlement?
No. That earlier state-court case, Nemeth v. Columbia University Health Care, covered about 29,000 patients whose lab data was exposed on a third-party website. It received final approval in December 2025, and its claim deadline has passed. The $16.1 million settlement covers the separate 2025 cyberattack on the university.
When will Columbia settlement payments be made?
Not before final approval. Judge P. Kevin Castel will hold the final approval hearing on February 23, 2027 at 2:00 p.m. ET, and benefits are paid only after the court approves the settlement and any appeals are resolved. No payment date had been announced as of October 29, 2026.
