Columbia University has reached a financial resolution with a class of approximately 2.97 million individuals affected by a significant cyberattack on its network in May 2025. According to The Daily Hodl, the Ivy League institution agreed to deposit $16,125,000 into a settlement fund to resolve the In re Columbia University Data Breach Litigation case currently pending in the U.S. District Court for the Southern District of New York. The breach compromised sensitive personal data, including Social Security numbers, financial records, medical information, and academic histories for a large portion of the university’s community.

Compensation Structure and Eligibility

The settlement defines the class as U.S. residents whose private information was compromised and who received notification of the incident. Columbia estimates the total number of class members at 2,973,631. Individuals who can provide documentation proving specific losses resulting from the attack may receive reimbursement of up to $8,500 each. Those without documented losses may opt for an alternative cash payment, which represents a share of the remaining funds in the settlement pool after the deduction of attorneys’ fees, administrative costs, and other approved expenses. This tiered approach aims to address both quantifiable financial damages and the broader impact on the affected population.

Additional Security and Monitoring Benefits

Beyond direct financial compensation, the agreement mandates that all class members who file a claim receive comprehensive identity protection services. These benefits include two years of free three-bureau credit monitoring and dark web monitoring. Additionally, claimants are entitled to up to $1 million in identity theft insurance and access to identity recovery services. These measures are designed to mitigate the long-term risks associated with the exposure of sensitive personal data, providing a safety net for those whose information was stolen during the May 2025 incident.

Columbia University denies any wrongdoing in the matter but has committed to maintaining enhanced security measures for a period of three years following the settlement. The court has set specific deadlines for the legal process: the deadline to opt out of or object to the settlement is December 22, 2026, while the final deadline to file a claim is January 21, 2027. A final approval hearing is scheduled for February 23, 2027. The Daily Hodl noted that it previously reported on the breach in August 2025, highlighting the extended timeline between the initial incident and the finalization of this legal resolution.