Columbia Breach Victims Can File for $16.1M
The settlement covers a breach whose affected count rose to roughly 3.1 million, with claims due January 21, 2027.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Do you trust large institutions to protect your personal data?
Columbia University has opened claims for a $16.1 million class action settlement over a cyber attack discovered in June 2025 that exposed Social Security numbers, addresses, financial-account details, academic histories and medical information. The settlement is a court-approved resolution of litigation and is not a product or technology development.
Why it matters
The affected-person count rose to roughly 3.1 million from about 870,000, showing how breach scope can grow well after initial disclosure. The settlement is the legal mechanism now defining compensation for people whose records were exposed.
The breach affected roughly 3.1 million people, a figure revised upward from about 870,000 in a May state filing. The $16.1 million settlement total has a claims deadline of January 21, 2027, and the exposed data varied by individual.
The players
Columbia University
A New York City research university whose systems were compromised in the breach and which agreed to the settlement.
Angeion Group
An independent claims administrator appointed by the court to manage settlement filings for affected individuals.
The details
The attack compromised Social Security numbers, addresses, demographic details, financial-account information, academic histories and medical information. Angeion Group, an independent third party appointed by the court, is administering claims. Affected people can file through Angeion using instructions sent to them, and claims may include credit monitoring, identity theft recovery help and cash payments.
Timeline
June 2025: Columbia discovered the cyber attack.
September 2025: Columbia agreed to the settlement.
May 2026: A filing with state officials cited about 870,000 affected people.
October 23, 2026: Columbia issued an update on the settlement agreement.
January 21, 2027: Deadline to file settlement claims.
The Tech Race
The settlement sets the compensation framework for a breach whose scope has grown roughly threefold since the initial count. The case shows how university data-security incidents now move from technical disclosure to court-administered claims.
Anyone whose information was exposed in the Columbia breach can file a claim through Angeion Group using instructions sent to them. Available benefits may include credit monitoring, identity theft recovery help and cash payments, with the claims deadline set for January 21, 2027.
The takeaway
Watch the January 21, 2027 claims deadline and whether the final affected-person count moves again from roughly 3.1 million. Affected individuals should file through Angeion Group before that date to preserve eligibility.
What happens next
Affected individuals must file claims through Angeion Group by January 21, 2027.
Further reading
For broader context on how institutions respond to data exposure, see Cybersecurity coverage across New York City.
More information
Claimants can review the settlement details on the Angeion claims and settlement information site.
Source note: This article includes information reported by Government Technology.
Live Poll
Do you trust large institutions to protect your personal data?
