Columbia University agreed to a $16.1 million settlement after a 2025 cyberattack compromised the data of roughly 3.1 million people. Claims are open through January 21, 2027. If you attended, worked at, or applied to Columbia, you may qualify for reimbursement of up to $8,500 in documented losses — or a cash payment that requires no documentation at all.

A cyberattack on Columbia University, discovered in June 2025, exposed Social Security numbers, bank account details, academic records, and medical information belonging to roughly 3.1 million people. Columbia has agreed to pay $16.1 million to settle the resulting class-action lawsuit — and the claims window is open right now.1

You have until January 21, 2027 to file. Here's what you need to know.

What Data Was Exposed

According to the settlement notice, the compromised data may include:

  • Social Security numbers
  • Bank and financial account details
  • Home addresses and demographic information
  • Academic histories and enrollment records
  • Medical information

The specific data exposed varies by individual. Not everyone in the class had every category compromised.

Who Can File a Claim

The settlement class is larger than most people assume. You may be eligible if you:

  • Attended Columbia as an undergraduate, graduate, or professional student at any point
  • Worked at Columbia as faculty or staff
  • Applied to Columbia — including applicants who were rejected or never enrolled
  • Received services from Columbia's medical center or its affiliates

If you received a notice by mail or email from the Angeion Group (the independent claims administrator), your contact information is already on file. Even without a notice, you can check eligibility by calling 1-833-617-4373.

Two Ways to Collect

The settlement offers two payment paths:

Option 1 — Documented losses (up to $8,500). You can be reimbursed for out-of-pocket costs caused by the breach: credit monitoring fees, identity theft repair expenses, time spent resolving fraud at $25 per hour (up to 10 hours), and direct financial losses. You'll need receipts or documentation linking the expense to the breach.

Option 2 — Alternative cash payment (no documentation required). You can claim a cash payment without showing proof of harm. The exact amount hasn't been set — it depends on how many people file and how much remains after attorney fees and administration costs.2

Attorney fees can reach up to $4,031,250. After legal costs and administrative fees, the no-documentation cash payment will likely be modest. If you experienced actual identity theft, unauthorized account access, or fraud you can trace to this breach, the documented-loss track is worth the extra paperwork.

Three Things Most People Won't Check

1. Your notification may be sitting in a spam folder. The Angeion Group began sending notices on October 23, 2026. Many landed in spam or junk mail because they came from a third-party domain and mentioned "data breach" in the subject line. Search your email for "Columbia" and "Angeion" before assuming you weren't notified.

2. You have until December 22, 2026 to opt out or object. If you believe your losses from this breach exceed $8,500 and you want to preserve your right to sue Columbia separately, you must formally opt out before December 22. After that date, filing a claim or doing nothing both bind you to the settlement terms.

3. Filing has no effect on your financial aid. Participating in the settlement does not affect any pending FAFSA applications, financial aid awards, or enrollment status at Columbia or any other institution. The settlement is a civil matter entirely separate from admissions and aid systems.

What to Do Before January 21

  1. Check eligibility — call 1-833-617-4373 or search "Columbia University data breach settlement Angeion" to find the settlement website
  2. Decide which payment track makes sense — documented losses can pay more, but require evidence
  3. Gather documentation if needed — credit monitoring bills, fraud reports, time logs
  4. Mark the final approval hearing — scheduled February 23, 2027; payments go out if the court approves the settlement

Why This Matters Beyond Columbia

The Columbia breach is part of a broader pattern of university data incidents. This past spring, the Canvas/Instructure breach exposed student data at schools across the country. University systems hold some of the most sensitive personal data you'll ever share: Social Security numbers, financial account information, medical records, and academic history — often kept on file for years after you leave.

If you've completed a FAFSA at any school, that application included your Social Security number and bank account information — the same categories exposed here. It's a reasonable time to check your credit report at AnnualCreditReport.com.

For current students: a free credit freeze with Equifax, Experian, and TransUnion is one of the most effective identity theft protections available. It doesn't interfere with your financial aid applications, student loan access, or campus life in any way — and it can be lifted in minutes if you need it.

The 2027-28 FAFSA is currently open, and families filing right now are sharing exactly the kind of financial data this breach exposed. Knowing where your data lives — and what recourse you have when it's compromised — is part of protecting yourself through the college process.

Footnotes

  1. Bloomberg Law. (2026, October). Columbia Opens Claims for $16 Million Data Breach Settlement (1). Bloomberg Law. https://news.bloomberglaw.com/class-action/columbia-opens-claims-for-16-million-data-breach-settlement ↩

  2. Settlement Insight. (2026, October 23). Columbia University Data Breach Settlement Notice Is Real: Claims Due Jan 21. Settlement Insight. https://settlementinsight.com/news/columbia-university-data-breach-settlement-notice-began-october-23-2026-16-125-million-2973631-class-members-claims-due-january-21-2027-opt-out-december-22 ↩