The Columbia University data breach settlement is a closed class: only people who were sent notice of the May 2025 cyberattack, and who have the unique Notice ID from the settlement notice, can be paid. Claims from anyone else will be rejected. For the 868,969 people Columbia reported as affected, the $16.1 million deal offers up to $8,500 in documented losses or a share of the fund in cash, plus two years of credit monitoring. Claims close January 21, 2027.
Status: Claims open, preliminary approval granted September 23, 2026 | Claim deadline January 21, 2027 (online or postmarked) | Opt out or object by December 22, 2026 | Final approval hearing February 23, 2027
Why the Notice ID Matters More Than Usual
Many breach settlements let anyone who believes they were affected submit a claim and leave it to the administrator to check. This one does not. The settlement class is individuals residing in the United States whose private information was compromised in the May 2025 cyberattack on Columbia and who were sent notice of the cyberattack. The notice describes it as a closed class, with benefits available only to class members who have a unique Notice ID.
Every claim, whatever benefit it asks for, requires that Notice ID. Columbia mailed notification letters in August 2025, and the court-approved settlement notice has now gone out to the class. Anyone who expects to qualify should find the settlement notice before the deadline rather than after.
Who Was Affected
Columbia reported to the Maine Attorney General’s office that 868,969 people were affected. They include applicants and prospective students, current and former students, employees and other university affiliates.
The exposed information varied by person. It included names, contact details, dates of birth, Social Security numbers, application and academic records, financial aid information, and insurance and health information.
Pick One Cash Option, Then Add Monitoring
| Documented losses | Reimbursement of up to $8,500 for losses incurred as a result of the cyberattack, with supporting documentation not prepared by the claimant, such as receipts or statements. Expenses already reimbursed are not covered. |
| Alternative cash payment | A share of what remains in the $16,125,000 fund after attorneys’ fees and expenses, service awards, administration costs, credit monitoring and approved documented-loss claims. No documentation needed. |
| Credit monitoring (optional add-on) | Two years of three-bureau credit monitoring with dark web monitoring, up to $1 million of identity theft insurance and identity recovery services. |
The notice itself does not put a dollar figure on the alternative cash payment. News reports on the September settlement motion estimated it at about $100. The real number depends on how many valid claims are filed, and class counsel will ask for attorneys’ fees of up to 25% of the fund, which also comes out before the cash is divided.
The settlement monitoring is not the same as the two years of Kroll monitoring Columbia offered on its own after the breach. A class member who accepted the Kroll service can still elect the settlement’s monitoring on a valid claim.
Columbia also committed to keep its added security measures in place for three years after the settlement takes effect.
The Lawsuit Behind the Deal
The settlement resolves In re Columbia University Data Breach Litigation, No. 1:25-cv-05541, in the U.S. District Court for the Southern District of New York. It combined ten lawsuits filed in July and August 2025 after Columbia disclosed the attack; the first, Quintero v. Trustees of Columbia University in the City of New York, was filed July 3, 2025.
The plaintiffs allege that Columbia negligently failed to protect personal information with cybersecurity measures suited to how sensitive the records were. Columbia denies any wrongdoing or liability, and the allegations have not been proven.
When Judge P. Kevin Castel granted preliminary approval on September 23, 2026, he struck eight of the thirteen conditions the draft notice had placed on people who want to object, finding they would “needlessly frustrate and discourage objections.”
Not the Irving Medical Center Case
An earlier, smaller Columbia case is easy to confuse with this one. Nemeth v. Columbia University Health Care was a $600,000 state-court settlement covering about 29,000 patients whose lab data was exposed on a third-party website. It received final approval in December 2025 and its claim deadline has passed. The $16.1 million settlement covers the separate 2025 cyberattack on the university.
Deadlines and Next Steps
| December 22, 2026 | Requests for exclusion and objections must be postmarked. |
| January 21, 2027 | Claims submitted online or postmarked. The notice gives no time of day. |
| February 23, 2027, 2:00 p.m. ET | Final approval hearing before Judge Castel at the Daniel Patrick Moynihan U.S. Courthouse in Manhattan, where he will also consider the fee request. |
Payments and credit monitoring follow only after final approval and the resolution of any appeals. No payment date had been announced as of October 29, 2026.
How to File
File through the official settlement website, ColumbiaUniversityDataSettlement.com, or print the paper claim form from the site and mail it to the settlement administrator. The notice says filing online is the quickest route. The process is free; any website or message asking for payment to join the Columbia settlement is not part of the court process. Our sister site follows the case on its Columbia University data breach settlement page.
Frequently Asked Questions
Can I file a Columbia claim without a Notice ID?
No. The notice describes a closed class, and every claim requires the unique Notice ID from the notice sent to class members. Claims from people without one will be rejected.
How much is the Columbia alternative cash payment?
The notice does not set an amount. It is a share of what is left in the $16,125,000 fund after fees, costs, credit monitoring and documented-loss claims. News reports on the settlement motion estimated it at about $100.
Can I get both the $8,500 documented-loss payment and the cash payment?
No. Each class member chooses one cash option, documented losses up to $8,500 or the alternative cash payment. Two years of credit monitoring can be elected with either one.
I already have Kroll monitoring from Columbia. Is that the same thing?
No. The Kroll monitoring was offered by Columbia on its own after the breach. The settlement offers a separate two years of three-bureau monitoring with up to $1 million of identity theft insurance to class members who elect it.
Is this the Columbia Irving Medical Center settlement?
No. That was a separate $600,000 state-court case, Nemeth v. Columbia University Health Care, covering about 29,000 patients. It received final approval in December 2025 and its claim deadline has passed.
When will Columbia settlement payments be made?
Only after Judge Castel grants final approval and any appeals are resolved. The final approval hearing is February 23, 2027, and no payment date had been announced as of October 29, 2026.
Sources
- Official settlement website — ColumbiaUniversityDataSettlement.com.
- Long Form Notice (PDF) — class definition, benefits, deadlines and final approval hearing.
- Docket for In re Columbia University Data Breach Litigation, No. 1:25-cv-05541 (S.D.N.Y.), including the motion for preliminary approval and the order granting it.
- Opinion and Order, September 23, 2026.
- Columbia Daily Spectator, “Columbia to settle June 2025 data breach lawsuit for $16.1 million” (September 21, 2026).
- OpenClassActions.com — Columbia University $16.1 Million Data Breach Settlement.
Source and credit: the settlement terms, deadlines and benefit details described above are drawn from our sister site’s reporting — OpenClassActions.com: Columbia University $16.1 Million Data Breach Settlement — which tracks this case against the court-approved notice and the official settlement website and is updated as the court rules.
Legal Disclaimer
This article is for informational purposes only and is not legal advice. OpenClassActions.org is a consumer news site, not a law firm and not the settlement administrator, and is not affiliated with any party to the case described. The allegations are allegations; unless a court has ruled, the defendants deny wrongdoing and no court has decided the merits. Deadlines, benefit amounts and payment timing can change as the court and the administrator act, so confirm current status on the official settlement website. You never need to pay anyone to file a claim or to receive a settlement payment.