Columbia University Data Breach Settlement: $16.1M, Claims Due Jan. 21

Columbia University Data Breach Settlement: $16.1M Fund, Claims Due January 21

A federal judge in Manhattan preliminarily approved a $16,125,000 class settlement over Columbia University's May 2025 cyberattack on September 23, 2026. The court-set Notice Commencement Date was October 23, 2026, and claims are due January 21, 2027. Nothing is final until a February 2027 hearing.

Information last verified on November 1, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article addresses one proposed class action settlement pending in the United States District Court for the Southern District of New York, and the federal and New York rules that govern it. It does not address claims against any other university, any other data incident, or the separate breach notification statutes of the other 49 states.

What Happened

Judge P. Kevin Castel entered a Preliminary Approval Order on September 23, 2026 in In re Columbia University Data Breach Litigation, Case No. 1:25-cv-05541 (PKC) (S.D.N.Y.). The order granted an unopposed motion for preliminary approval docketed as Dkt. No. 58 and brought by 18 named plaintiffs against the Trustees of Columbia University in the City of New York.

The underlying incident is defined in the settlement agreement as "the incident that occurred in or around May 2025 that was discovered by Columbia in or around June 2025, in which one or more unauthorized third parties accessed Settlement Class Members' Private Information." Related cases were consolidated by an earlier order entered December 11, 2025 at Dkt. 36.

Columbia denies any wrongdoing or liability. The court-authorized notice is explicit that no finding has been made: the court "has not made any judgment or other determination of any wrongdoing or that the law has been violated."

Who Is Eligible

The Preliminary Approval Order found the court will likely be able to certify a settlement class, for settlement purposes only, defined in these words:

"All individuals residing within the United States whose Private Information was potentially accessed by one or more unauthorized third parties during the Cyberattack, including all who were sent notice of the Cyberattack." Source: Preliminary Approval Order, In re Columbia University Data Breach Litigation, No. 1:25-cv-05541 (PKC) (S.D.N.Y. Sept. 23, 2026), at paragraph 2

Excluded are Columbia and its parents, subsidiaries, affiliates, officers and directors and any entity it controls; anyone who timely opts out; defense counsel and their immediate families; and the judges assigned to the case and their immediate families.

The long-form notice states that Columbia estimates there are 2,973,631 settlement class members. The notice sets out the plaintiffs' allegation that the data involved included full names, dates of birth, addresses, contact details, genders, ethnicities, citizenship statuses, Social Security numbers, driver's license numbers, financial account information including card, bank account and routing numbers, medical information, health insurance information, academic histories, financial aid information, test scores, academic grades, admission decisions, expected graduation dates and tuition information.

There is one practical gate that decides whether a reader can file at all:

"This is a closed class and the benefits described herein are available only to Settlement Class Members with a unique Notice ID Number. Claims submitted by non-Settlement Class Members will be rejected." Source: Long Form Notice, In re Columbia University Data Breach Litigation, No. 1:25-cv-05541 (PKC), Question 11

The claim form has a field for that Notice ID Number and says it is "provided on the Notice you received by email or mail." Under the settlement agreement, the postcard notice is to be disseminated by email and U.S. Mail to known addresses, and notice is also to be published on the settlement website.

What the Settlement Provides

Class members who submit a valid claim may elect one of two cash options, and may separately elect credit monitoring.

Credit monitoring, at no cost. Two years of three-bureau credit monitoring, dark web monitoring, identity theft insurance coverage up to $1,000,000, and fully managed identity recovery services. The notice describes these as available "at no cost to you" in addition to either cash option. This is the benefit that requires no receipts and no loss.

Reimbursement for documented monetary losses, up to $8,500. This is a ceiling, not a payment. The claim form requires a bank or credit card statement or other third-party proof of the exact amount claimed, and states that self-prepared documents are by themselves insufficient. The settlement agreement treats a loss as fairly traceable if it occurred on or after May 16, 2025, or the earliest verifiable date the cyberattack occurred, and involved the same type of private information potentially exposed in the cyberattack. The court-authorized notice states the cutoff simply as May 16, 2025.

Alternative cash payment. A pro rata share calculated by "distributing the remaining Settlement Fund after deduction or payment of Court-approved attorneys' fees and litigation expenses, Service Awards, Settlement Administration Costs, Credit Monitoring costs, and approved claims for Documented Monetary Losses." The notice adds that payment "may be reduced on a pro rata basis depending on the number of claims submitted." If a documented-loss award would come out smaller than the alternative cash payment, the agreement says the class member receives the larger amount.

Business practice commitments. Columbia has committed to maintain additional security measures for three years after the settlement's effective date. The agreement defines "Columbia University" for this purpose as central administration only, expressly excluding Columbia University Irving Medical Center and affiliate institutions such as Barnard College, Teachers College, Union Theological Seminary and the Jewish Theological Seminary, as well as students and faculty.

The fund is non-reversionary, meaning unclaimed money does not go back to Columbia. Columbia was required to deposit the full $16,125,000 into escrow within 30 days of preliminary approval and, once funded, is not required to pay anything more. Money left over from uncashed checks is redistributed pro rata to alternative cash payment claimants, subject to a $5.00 minimum payment, with any remainder going to a court-approved cy pres recipient.

The Deadlines the Court Set

The hearing is set before Judge Castel in Courtroom 11D of the Daniel Patrick Moynihan United States Courthouse, 500 Pearl Street, New York. The order reserves the right to adjourn it without further written notice to the class, and says it may be held remotely. Any change is to be posted on the settlement website.

Class counsel will ask the court to award attorneys' fees of up to 25 percent of the fund, stated in the notice as $4,031,250, plus litigation expenses, and service awards of $500 for each class representative. That motion must be filed 14 days before the objection and opt-out deadlines, so class members can read it before deciding whether to object. The court appointed Angeion Group, LLC as settlement administrator and appointed as class counsel William B. Federman of Federman & Sherwood, Ashley M. Crooks of Hausfeld LLP, Rachele R. Byrd of Wolf Haldenstein Adler Freeman & Herz LLP, and Charles E. Schaffer of Levin Sedran & Berman, LLC.

What the Law Actually Says

Preliminary approval is a procedural gate, not a ruling on the merits, and the governing rule says so in terms. Federal Rule of Civil Procedure 23(e)(1)(B) directs a court to give notice only once the parties show the court "will likely be able to" approve the proposal under Rule 23(e)(2) and certify the class for judgment. That "likely" standard is the whole of what has happened so far.

"Upon preliminary review, the Court finds the Settlement is fair, reasonable and adequate to warrant providing notice of the Settlement to the Settlement Class and accordingly is preliminarily approved." Source: Preliminary Approval Order, No. 1:25-cv-05541 (PKC) (S.D.N.Y. Sept. 23, 2026), at paragraph 13

Final approval runs through Rule 23(e)(2), which permits approval only after a hearing and only on finding the settlement fair, reasonable and adequate after considering whether class representatives and counsel adequately represented the class, whether the proposal was negotiated at arm's length, whether the relief is adequate, and whether the proposal treats class members equitably relative to each other. Fees are governed separately by Rule 23(h). The court took jurisdiction under the Class Action Fairness Act diversity provision, 28 U.S.C. 1332(d)(2), and CAFA also required notice of the proposed settlement to state and federal officials under 28 U.S.C. 1715(b).

Two New York statutes supply the standing duties that a negligence theory against a New York institution leans on. New York General Business Law section 899-aa requires any person or business that owns or licenses computerized data including private information to disclose a breach to any affected New York resident "in the most expedient time possible and without unreasonable delay," and within 30 days after the breach has been discovered, except for the legitimate needs of law enforcement. Section 899-bb, added by the SHIELD Act, separately requires any person or business owning or licensing the private information of a New York resident to "develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity" of that information, and enumerates administrative, technical and physical safeguards including detecting, preventing and responding to attacks or system failures.

Notably, the claims pleaded are all state-law and common-law theories: negligence, breach of implied contract, unjust enrichment, breach of bailment, several state consumer protection statutes, California constitutional invasion of privacy, the California Customer Records Act and the Tennessee Personal Consumer Information Release Act. There is no federal student-privacy claim. In Gonzaga University v. Doe, 536 U.S. 273, 276 (2002), the Supreme Court held "such an action foreclosed because the relevant provisions of FERPA create no personal rights to enforce under 42 U.S.C. [section] 1983." Private enforcement of the federal student-records statute is therefore unavailable on that route, and the complaints here were pleaded on state common-law and consumer protection theories instead. The PowerSchool Naviance student privacy settlement, another education-data matter, was resolved on state-law theories as well.

Finally, the credit freeze the notice does not mention is the one benefit no settlement controls. Federal law at 15 U.S.C. 1681c-1(i) requires a nationwide consumer reporting agency to place a security freeze "free of charge" once it has the consumer's direct request and proper identification, within one business day of a request made by toll-free telephone or secure electronic means and within three business days of a mailed request, and to send confirmation of the placement within five business days. The Federal Trade Commission states plainly that "There's no cost to place or lift a credit freeze, and it doesn't affect your credit score," that "A credit freeze lasts until you lift it," and that while one is in place "nobody can open a new credit account in your name, including you." Our step-by-step walkthrough of placing a free freeze at all three bureaus covers the mechanics.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The arithmetic here is worth stating openly, because the $8,500 number is a reimbursement ceiling that requires third-party proof of an actual loss, not a figure the fund pays out by default. Start from $16,125,000. Subtract the $4,031,250 in fees class counsel says it will request and $9,000 in service awards for 18 class representatives, and roughly $12.08 million remains before litigation expenses, administration costs, credit monitoring costs and documented-loss claims, all of which the notice says come out first. Spread across 2,973,631 estimated class members, that is about four dollars per person.

That four-dollar figure is not a forecast. It is what the arithmetic yields if every single class member filed, before the litigation expenses, administration costs, credit monitoring costs and documented-loss claims that also come out of the fund first, so the real figure in that scenario would be lower still. The alternative cash payment is defined as a single share of the net fund subject to pro rata adjustment, so the fewer valid claims the administrator approves, the larger each share, and the more claims, the smaller. Nobody can state the amount today, which is exactly what the pro rata language in the agreement means, and it is why the notice itself declines to name a number. The notice does say it "is anticipated that the Settlement Fund will be sufficient to provide cash payments to all Settlement Class Members who submit eligible claims," while adding that payments may be reduced pro rata depending on how many are filed.

That is not a criticism of the settlement. It is the structural reality of any common fund divided among a class approaching three million people, and it is why the credit monitoring election deserves attention: it is the one benefit on the claim form that is not rationed by how many other people file.

The closed-class mechanic deserves attention. A class defined to include everyone "potentially accessed" could in principle reach people who never got a letter. The notice's own summary page and the official settlement website both state the class more narrowly, as United States residents whose private information was compromised in the cyberattack and who were sent notice of it. The notice then forecloses the broader reading in practice, by conditioning benefits on a unique Notice ID Number and stating that claims from non-class members will be rejected. For a breach at an institution holding admissions and financial aid records for applicants who never enrolled, that is a meaningful line: the operative question is not whether your data was at Columbia but whether Columbia's records identified you and sent you a notice.

One procedural detail is also worth flagging. The Preliminary Approval Order approved the notice documents "subject to the revisions directed in this Court's accompanying Opinion and Order," which indicates the court required changes to the notice program before letting it go out. That accompanying opinion is not posted among the documents on the settlement website, and we have not read it, so we are not characterizing what it required.

How This Affects You

If you received a notice with a Notice ID Number, the deadlines in the table above are the operative dates, and they are court-set rather than marketing deadlines. Claims are due January 21, 2027; the exclusion and objection deadline is December 22, 2026.

Doing nothing has a specific legal consequence that is easy to miss. The notice states that a class member who does nothing receives no settlement benefits and still gives up the right to start or continue a lawsuit against the released parties about the legal issues this settlement resolves. Doing nothing is not neutral; it is staying in the class without claiming.

Opting out is the only way to preserve an individual lawsuit. It requires a signed written request identifying the case name and number, mailed and postmarked by December 22, 2026, and it cannot be done by phone or email. The agreement also bars mass or class exclusion requests filed by third parties on behalf of multiple class members without each person's signature. Anyone with a pending individual suit has a different problem than the general class, and the notice tells those readers to speak to their own lawyer in that case.

Objecting is different from opting out. An objector stays in the class, stays bound if the court approves the settlement, and tells the court in writing what they think is wrong, including about the fee request. The notice confirms the court will consider timely objections and hear class members who ask to speak.

On protecting yourself, the sequencing matters. A credit freeze is free by federal statute, available today, and does not depend on this settlement or any court approval. Enrolling in the settlement's credit monitoring is additive, not a substitute. We would not point any reader toward a paid identity-protection subscription in this posture, because the settlement supplies two years of three-bureau monitoring at no cost and the statutory freeze is free indefinitely. Our general checklist for what to do after a data breach walks through the order of operations.

Finally, the copycat problem. The administrator publishes the official site as www.ColumbiaUniversityDataSettlement.com and the toll-free line as 1-833-617-4373, with the administrator's mail address at 1650 Arch Street, Suite 2210, Philadelphia, PA 19103, and exclusions and objections going to PO Box 58220, Philadelphia, PA 19102. Check the domain character by character before entering anything, and treat any site with a similar name, an urgency banner, or a request for payment as suspect. Recordinglaw.com is not the administrator, not the court, and not a filing venue; we do not collect claim information and no claim can be filed here. Large, widely covered breaches attract lookalike sites even when no claims process exists at all, which is the situation on the National Public Data breach, where there is no settlement and no claim form.

What Happens Next

The next scheduled event is class counsel's motion for attorneys' fees, litigation expenses and service awards, due 14 days before the December 22, 2026 objection and opt-out deadlines and required to be posted on the settlement website. The motion for final approval is due 14 days before the hearing, and the administrator must report opt-outs and objections 16 days before it.

The event that would turn this into a completed legal development is the February 23, 2027 final approval hearing and the Final Approval Order that may follow. At that hearing the court will decide whether to certify the class for judgment, whether to approve the settlement as fair, reasonable and adequate under Rule 23(e), whether to dismiss the action with prejudice, and what fees and service awards to allow.

Payment does not follow immediately even then. The agreement sets the effective date at five days after entry of the Final Approval Order if there are no objections. If there are objections, it is 30 days after entry when no appeal is taken, or, if an appeal is taken, whichever comes first of 30 days after the last appellate ruling affirming the order and 30 days after dismissal of the appeal. Benefit amounts can still change, and the settlement can still fail: the order states it becomes null and void if no final approval order and judgment are entered or there is no effective date.

This is general legal information, not legal advice. It covers a single federal class action settlement pending in the Southern District of New York and the federal and New York law that governs it, and reflects sources verified on November 1, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• How to freeze your credit for free after a breach
• A step-by-step guide to what to do after a data breach
• PowerSchool Naviance settlement: approved, not yet paid
• Why the National Public Data breach has no claim form
• Court approves the $5M EyeMed data breach settlement

---

Last updated: 2026-11-01. This is a developing story; details verified as of 2026-11-01.

Frequently Asked Questions

Am I in the Columbia University data breach settlement class?

The Preliminary Approval Order of September 23, 2026 defines the class as all individuals residing within the United States whose private information was potentially accessed by unauthorized third parties during the May 2025 cyberattack, including all who were sent notice of it. The notice's summary page and the official settlement website both state the class more narrowly, as United States residents whose private information was compromised in the cyberattack and who were sent notice of it. In practice the notice conditions benefits on having a unique Notice ID Number from the notice Columbia's administrator sent by email or mail.

What is the claim deadline?

Claim forms must be submitted online or postmarked by January 21, 2027, which is 90 days after the court-set Notice Commencement Date of October 23, 2026. The objection and exclusion deadline is earlier, December 22, 2026.

How much money will class members actually receive?

No amount is promised or knowable yet. The $8,500 figure is a cap on reimbursement for documented monetary losses supported by third-party proof. The alternative cash payment is a pro rata share of what remains of the $16,125,000 fund after court-approved fees, litigation expenses, service awards, administration costs, credit monitoring costs and approved documented-loss claims, and the notice says it may be reduced depending on how many claims are filed.

What if I never received a Notice ID Number?

The long-form notice states this is a closed class and that benefits are available only to settlement class members with a unique Notice ID Number, and that claims submitted by non-class members will be rejected. The notice directs anyone unsure of their status to the official settlement website or the administrator's toll-free line at 1-833-617-4373.

Is the Columbia settlement final?

No. Judge P. Kevin Castel granted preliminary approval only on September 23, 2026, which under Federal Rule of Civil Procedure 23(e)(1)(B) requires just a showing that the court will likely be able to approve the settlement. The notice states there will be no settlement benefits unless the court approves the settlement at or after the February 23, 2027 final approval hearing and it becomes final.

What happens if I do nothing?

Under the court-authorized notice, a class member who does nothing receives no settlement benefits and still gives up the right to start or continue a lawsuit against the released parties about the legal issues this settlement resolves, if the court approves it. Doing nothing is not the same as staying out.

How do I opt out of the Columbia settlement?

The order and notice require a written request for exclusion that identifies the case name and number, is personally signed, gives your name, address, telephone number and email, and states that you want to be excluded, mailed to the administrator and postmarked by December 22, 2026. It cannot be done by telephone or email, and third-party mass exclusion requests without each individual's signature are not allowed.

How can I tell a fake Columbia settlement claim site from the real one?

The court-appointed administrator, Angeion Group, publishes the official site as www.ColumbiaUniversityDataSettlement.com and the toll-free number as 1-833-617-4373. No legitimate class settlement charges a fee to file a claim. Recordinglaw.com is not the administrator, the court or a filing venue, and claims cannot be submitted here.

Is the credit monitoring in this settlement free, and do I need to buy identity protection?

The notice and claim form describe two years of three-bureau credit monitoring, dark web monitoring, identity theft insurance up to $1,000,000 and managed identity recovery as available at no cost to class members who elect them. Separately, a security freeze is free by federal law under 15 U.S.C. 1681c-1(i), and the FTC states there is no cost to place or lift one and that it does not affect your credit score.