Columbia University $16.13 Million Data Breach Settlement, Who Qualifies for Up to $8,500 or a Cash Payment?

Columbia University has agreed to a $16.125 million settlement resolving a class action over a May 2025 cyberattack that allegedly exposed sensitive personal information held by the university. Eligible U.S. residents may claim up to $8,500 for documented losses or an alternative cash payment, plus two years of credit monitoring and identity-theft protection.

The claim deadline is January 21, 2027. The opt-out and objection deadline is earlier: December 22, 2026. A federal judge has granted preliminary approval, but the settlement is not yet final. The alternative cash payment is not a guaranteed $100 check; the final amount depends on the settlement fund, approved expenses and the number of valid claims.

Website notice: As checked on October 29, 2026, the official settlement homepage and claim form list January 21, 2027 as the deadline, but the separate online “Submit Claim” page displayed a message that the deadline had passed. Before relying on online filing, call the administrator at 1-833-617-4373 to confirm the working submission method. The official claim form is also available as a PDF for mailing.

Columbia University Data Breach Settlement: Quick Facts

Detail	Information
Settlement amount	$16,125,000
Defendant	Trustees of Columbia University in the City of New York
Case name	In re Columbia University Data Breach Litigation
Case number	1:25-cv-05541 (PKC)
Court	U.S. District Court, Southern District of New York
Judge	P. Kevin Castel
Cyberattack	May 2025
Estimated class size	2,973,631 people
Documented-loss benefit	Up to $8,500
Alternative cash payment	Depends on the remaining fund and approved claims
Identity protection	Two years of credit monitoring and identity-theft protection
Opt-out / objection deadline	December 22, 2026
Claim deadline	January 21, 2027
Final approval hearing	February 23, 2027, 2 p.m. ET
Settlement administrator	Angeion Group, 1-833-617-4373
Official website	ColumbiaUniversityDataSettlement.com

What Happened in the Columbia University Data Breach?

According to the settlement agreement, an unauthorized third party accessed private information maintained by Columbia during a cyberattack in or around May 2025. Columbia discovered the incident in or around June 2025 and began notifying affected individuals on or about August 7, 2025.

The settlement notice lists categories of information that may have been involved:

• Names, dates of birth, addresses and contact details.
• Social Security numbers and driver’s license numbers.
• Financial account information, including credit card, debit card and bank account details.
• Medical and health insurance information.
• Academic histories, test scores, grades, admission decisions and expected graduation dates.
• Financial aid and tuition information.
• Other personal characteristics and status information.

These are categories identified in the court-authorized notice. They do not mean every person’s information was exposed in every category. Your individual notice is the best place to check what applies to you. The estimated class of 2,973,631 people is the size of the class, not the number of people expected to be paid.

Why Was Columbia University Sued?

The lawsuits alleged that Columbia failed to adequately protect sensitive personal information. Claims included negligence, breach of implied contract, unjust enrichment and violations of state consumer-protection and privacy laws. The cases were consolidated as In re Columbia University Data Breach Litigation in federal court in New York.

Columbia denies wrongdoing and liability, and the parties settled to avoid the risks, costs and delays of continued litigation. The court has not ruled on the merits. Preliminary approval only allows the settlement to move forward to notice and claims; it is not a finding that Columbia violated the law.

For readers following similar cases, see our coverage of the ConnectOnCall $4,950,000 data breach settlement, which involved health-related information.

Who Qualifies for the Columbia University Settlement?

The settlement class generally includes individuals residing in the United States whose private information was potentially accessed in the May 2025 cyberattack and who were sent notice of the incident. Eligibility is not limited to current students. The university held information tied to students, applicants, employees, alumni and others.

You may qualify if you:

• Reside in the United States and fall within the class definition.
• Were potentially affected by the May 2025 cyberattack.
• Have not properly opted out.
• Submit a valid claim by the deadline to receive a payment or identity-protection benefits.

Excluded are Columbia and specified related entities, people who properly opt out, Columbia’s counsel and their immediate family members, and the judges assigned to the case and their immediate family members.

Do you need a breach notice?

The settlement describes a closed class, and the claim form asks for a unique Notice ID from the notice sent by email or mail (keep any confirmation code printed on it as well). If you think your information was affected but never received a notice, do not assume you are in or out. Contact the administrator at 1-833-617-4373 and ask whether you are within the class and how to proceed.

How Much Can You Receive?

The $16.125 million is the total fund, not an equal share for each person. Eligible claimants choose one monetary option and may also elect identity-protection services.

Option 1: Up to $8,500 for documented losses

You may claim up to $8,500 for qualifying, unreimbursed losses linked to the cyberattack, which can include:

• Expenses caused by identity theft or fraud.
• Losses from falsified tax returns or other misuse of your information.
• Related costs such as notary, fax, postage, copying, mileage and long-distance phone charges.
• Credit monitoring and other mitigation costs incurred on or after May 16, 2025, through the date you submit your claim.

Losses must be documented, connected to the incident and not already reimbursed by another source. The type of private information used in any fraud must also match the type potentially exposed. Bank statements, credit card statements or other proof of actual charges may be submitted, and you may redact unrelated transactions and all but the last four digits of account numbers. Self-prepared documents alone are not enough, though they can help explain other evidence.

The $8,500 figure is a maximum, not a guaranteed payment. You can recover only qualifying amounts you can support. Other cases use similar structures; for example, the CBIZ data breach settlement offers a small cash option or a larger documented-loss claim, but each settlement has its own rules.

Related article: Snap Finance $664M Settlement, Who Gets Lease Forgiveness in 17 States?

Option 2: Alternative cash payment

Instead of documented losses, you can select an alternative cash payment. The official claim form does not promise a fixed amount. The payment depends on what remains in the fund after court-approved attorneys’ fees and expenses, service awards, administration costs, credit-monitoring costs and approved documented-loss claims.

The notice says the fund is anticipated to cover cash payments to all class members who submit eligible claims, but payments may be reduced proportionally depending on the number of claims. Bloomberg Law described the expected payment as roughly $100 when reporting on the proposed settlement. That is an estimate, not an official guarantee.

You cannot claim both monetary options. If you are comparing structures, the Benworth Capital Partners data breach settlement uses a similar either-or design.

Two years of credit monitoring and identity protection

In addition to either monetary option, eligible class members may elect two years of free services, described as including:

• Three-bureau credit monitoring.
• Dark-web monitoring.
• Identity-theft insurance of up to $1 million.
• Fully managed identity-recovery services.

The claim form has a separate selection for these services, so make sure you tick it and provide a current email and mailing address.

Columbia’s security commitments

Columbia says it has been implementing additional security measures, including defensive tools and increased monitoring, and has agreed to maintain them for three years after the settlement’s effective date. This is separate from the cash and credit-monitoring benefits.

Tax note

The tax treatment of settlement payments can depend on your situation. Consider speaking with a qualified tax professional before filing your return.

How to File a Columbia University Data Breach Claim

You must submit a valid claim by January 21, 2027 to receive either monetary benefit or the identity-protection services.

1. Confirm you are in the class. Review the official settlement website and FAQs, and find your Notice ID in the original email or letter.
2. Choose one monetary benefit. Select documented losses (up to $8,500) or the alternative cash payment. You may also elect the two years of identity protection.
3. Complete the claim form. Use the official online claim page only if the administrator confirms it is accepting claims; otherwise use the official paper claim form (PDF). It asks for your Notice ID, name, address, email, phone number, selected benefit and signature.
4. Attach proof if claiming losses. Include statements or records for each expense, redact unrelated transactions, and leave out anything already reimbursed.
5. Submit on time. Claims must be submitted online or postmarked by January 21, 2027. Mail to:

Columbia University Data Settlement Administrator
1650 Arch Street, Suite 2210
Philadelphia, PA 19103

Keep a copy of your form and records, and tell the administrator if your contact details change.

Deadline to Opt Out or Object: December 22, 2026

Both deadlines fall one month before the claim deadline.

How to opt out

Opting out removes you from the settlement. You would receive no benefits but may preserve your right to pursue the covered claims separately, subject to applicable law. A written request must include the case name and number, your full name and current contact information, a statement that you want to be excluded, and your physical signature. It must be postmarked by December 22, 2026; you cannot opt out by phone or email.

Columbia University Data Settlement Administrator, Attn: Exclusions
P.O. Box 58220
Philadelphia, PA 19102

How to object

An objection tells the court why you disagree with part of the settlement. If you object, you remain in the class and do not preserve the right to sue separately. Follow the notice’s filing instructions carefully. Objections are mailed to:

Columbia University Data Settlement Administrator, Attn: Objections
P.O. Box 58220
Philadelphia, PA 19102

If you are unsure whether to opt out, object or stay in, consider seeking independent legal advice.

What Happens If You Do Nothing?

You will receive no benefits. If the court approves the settlement and you remain in the class, you will still be bound by the release of covered claims, so doing nothing does not preserve your ability to sue later. To get benefits, claim by January 21, 2027. To keep the right to sue on your own, opt out by December 22, 2026.

When Will Payments Be Sent?

There is no confirmed payment date. The final approval hearing is set for February 23, 2027, at 2 p.m. ET before Judge P. Kevin Castel at the Daniel Patrick Moynihan United States Courthouse, Courtroom 11D, 500 Pearl Street, New York. The court will consider whether the settlement is fair, reasonable and adequate, along with requests for fees, expenses and service awards.

Class counsel will request attorneys’ fees of up to 25% of the fund ($4,031,250) plus litigation expenses, and $500 service awards for each class representative. The court may award less. Class counsel includes William B. Federman of Federman & Sherwood, Ashley M. Crooks of Hausfeld LLP, Rachele R. Byrd of Wolf Haldenstein Adler Freeman & Herz LLP, and Charles E. Schaffer of Levin Sedran & Berman LLC. Benefits are provided only after final approval and any appeals are resolved.

Frequently Asked Questions

Is the Columbia University data breach settlement final?

No. The court granted preliminary approval, and final approval is pending, with a hearing on February 23, 2027.

Can I receive $8,500 automatically?

No. $8,500 is the maximum for qualifying documented losses. You must submit a valid claim with supporting evidence.

Is the alternative cash payment guaranteed to be $100?

No. About $100 was reported as an estimate, but the agreement does not guarantee it. The final amount depends on the remaining fund and approved claims.

Can I claim both cash options?

No. Choose either documented-loss reimbursement or the alternative cash payment. You can add the two years of identity protection to either.

Do I have to be a Columbia student?

No. The class is not limited to students and may include other U.S. residents whose information was potentially accessed, subject to the class definition and exclusions.

What are the deadlines?

Opt-out and objection: December 22, 2026. Claim: January 21, 2027. The online claim page showed a conflicting message on October 29, 2026, so confirm with the administrator.

When will payments arrive?

No date is confirmed. Payments follow final approval and the resolution of any appeals.

How do I contact the settlement administrator?

Call Angeion Group at 1-833-617-4373 or write to 1650 Arch Street, Suite 2210, Philadelphia, PA 19103.

Official Documents and Sources

• Official Columbia University Data Settlement Website
• Official Settlement FAQs
• Official Claim Submission Page
• Long-Form Settlement Notice (PDF)
• Class Action Settlement Agreement and Release (PDF)
• Official Claim Form (PDF)
• Preliminary Approval Order (PDF)
• Court’s September 23, 2026 Opinion and Order on the Notice
• Bloomberg Law report on the proposed settlement
• Columbia Daily Spectator report, October 28, 2026

This article is for informational purposes only. AllAboutLawyer.com is not a law firm and does not provide legal advice. The court-authorized notice and settlement agreement control eligibility, benefits, deadlines and claim procedures.