Columbia University has agreed to pay $16,125,000 to settle a class action over the May 2025 cyberattack that exposed Social Security numbers and other personal details of about 3.1 million people. Anyone who received a breach notice from the university has until Jan. 21, 2027 to file a claim for documented losses of up to $8,500, a cash payment or free credit monitoring.
The class covers people living in the United States whose private information was compromised in the attack and who were sent notice of it. Filing a claim form is the only way to receive any of the settlement benefits, and the form can be sent online or by mail. A mailed form has to be postmarked by Jan. 21, so anyone holding the notice should decide this winter rather than in January.
Retirement deadlines, in your inbox: Miss an enrollment or claim deadline and the money can be gone. Join the Retirement Money Brief and we’ll send you our Open Settlements & Refund Tracker as a welcome gift.
Get the Brief + the settlements tracker →
We may earn a commission from links on this page.
Who is covered, and how big the breach turned out to be
The settlement website says the class includes individuals residing in the United States whose private information was compromised in the cyberattack and who were sent notice of it. The case is In re Columbia University Data Breach Litigation, No. 1:25-cv-05541, in the U.S. District Court for the Southern District of New York. The official settlement website carries the claim form and says to check back for updates.
The count of people affected grew sharply. An early state filing in May put it at about 870,000. Bloomberg later reported roughly 3.1 million, according to a Nov. 2 GovTech report. The exposed data varied by person and included Social Security numbers, addresses, demographic details, financial account information, academic histories and medical information.
Columbia has said its investigation found the attacker’s stated motive was political, with no sign of a financial motive or of data being sold on the dark web. That finding does not change what the settlement pays. Class members get the same benefits whether or not their details have shown up anywhere.
The timeline is short. GovTech reports that Columbia found the attack in June 2025, agreed to the class settlement in September 2026, won preliminary approval from the court and saw claims open in late October.
What the $16.1 million pays
The settlement offers two ways to be paid, and class members choose one. The first is reimbursement of documented losses, up to $8,500 per person. Those losses have to be backed by receipts or other supporting records, such as bank statements, and not by a self-prepared list.
The second is an alternative cash payment, and the settlement does not set a fixed amount for it. The money is whatever remains in the fund after attorney fees, expenses, service awards, administration costs, the cost of credit monitoring and approved documented-loss claims. More valid claims mean smaller checks, which is why the administrator cannot say in advance what each person will receive.
Class members make these elections on the claim form, which can be completed on the “Submit Claim” page of the settlement website or on paper. Someone who files late or skips the form receives nothing, even with a notice in hand.
Credit protection is separate and can be added to either choice. Class members can elect two years of three-bureau credit monitoring, dark web monitoring, identity theft insurance up to $1,000,000 and fully managed identity recovery. Columbia also committed to keep added security measures in place for three years after the settlement takes effect.
The four dates on the notice
Dec. 22, 2026 is both the opt-out deadline and the objection deadline. Anyone who opts out keeps the right to sue Columbia separately but gives up the settlement benefits, so most people who want money from this deal will skip that step. The claim deadline, Jan. 21, 2027, is the one that decides payment.
The court’s final approval hearing is set for Feb. 23, 2027 in the Southern District of New York. The settlement website does not list a courtroom and tells class members to watch the site for updates.
Angeion Group, the settlement administrator, runs the claims process. It can be reached at 1-833-617-4373 or through the settlement website. Mailed paper forms go to the administrator, which is based in Philadelphia, and the postmark date is what counts.
Choosing between receipts and a cash payment
A documented-loss claim takes more work but can pay far more. Someone who paid for credit freezes, fraud-related bank fees, replacement cards or time lost to an identity theft tied to the breach can list those costs and attach the records. Someone with no out-of-pocket losses has only the cash payment and the monitoring to choose from.
The monitoring and identity theft insurance cost nothing to elect, and the settlement lets class members take them alongside either payment option. For retirees whose Social Security number was in the file, two years of three-bureau monitoring is the benefit most likely to matter, because a stolen number can be misused long after a breach.
The findings on the attacker’s motive come from the university’s own breach update, dated Oct. 23. The settlement site remains the place for the claim form and for any change to the hearing date.
Holding a Columbia breach notice before Jan. 21?
A claim form filed after Jan. 21, 2027, or a mailed one without a postmark by that date, gets nothing, and a loss with no receipt behind it cannot be reimbursed. The notice, the receipts and the dates all have to line up before the form goes in.
The Settlement & Refund Recovery System is built for that job. It teaches the four-date rule for reading a settlement notice, so the opt-out, objection, claim and hearing dates sit in one place, and it includes a step-by-step filing walkthrough plus a claim log and payment tracker for keeping receipts and expected payouts together.
This article was produced with AI assistance and edited for accuracy against the sources linked above.
