Columbia University's $16 million data breach settlement is now taking claims

Free daily briefing on global business news.

Global business news for a smarter world

Affected people can seek credit monitoring, identity-theft restoration services and cash payments; claims are due Jan. 21, 2027

UCG / Getty Images

Columbia University is now accepting claims from people affected by last year's cyberattack, who can seek a share of the $16.1 million class action settlement, according to Bloomberg. The deadline to file is Jan. 21, 2027, according to Bloomberg.

Columbia reached an agreement to resolve class action litigation brought on behalf of people who may have been affected by the breach, the university said in an update dated Oct. 23. The court has granted preliminary approval to the agreement, the university said.

Angeion Group, an independent third party appointed by the court, is managing claims under the agreement. People whose information was affected will receive instructions on how to submit a claim, along with information about additional credit monitoring, the university said. Questions about the notice or the claims process should go to Angeion at www.ColumbiaUniversityDataSettlement.com or 1-833-617-4373.

Affected people can receive credit monitoring, help recovering from identity theft and cash payments, according to Bloomberg. Columbia agreed to the settlement in September, according to Bloomberg.

The exposed information covered Social Security numbers, addresses, demographic details, financial-account information, academic histories and medical information, according to Bloomberg, citing the notification sent to affected people. The data exposed varied by individual, according to Bloomberg.

Columbia counts roughly 3.1 million affected people, according to Bloomberg. That is up from about 870,000 in an earlier count, according to Bloomberg, which cited a May filing with state officials. Columbia learned of the attack in June 2025, according to Bloomberg.

The university's investigation found the hacker's stated motivation was political, Columbia said. The university said its investigation turned up no sign that money was the motive for the attack, or that the stolen data was sold or spread on the dark web.

Columbia said it took steps to strengthen its data security and governance practices after discovering the attack. As part of the agreement, the university also committed to further enhance its cybersecurity program.

Join 500,000+ readers who start their day with Quartz.

By subscribing, you agree to our Terms of Service and Privacy Policy.