Columbia University Data Breach Settlement: How to Claim Up to $8,500

Nearly 3 million people may soon receive payouts after the Trustees of Columbia University in New York agreed to a $16.125 million settlement to resolve a class action lawsuit. The agreement follows a May 2025 cyberattack that exposed a massive trove of sensitive personal data, including Social Security numbers, financial account details, and medical and academic records.

Eligible claimants can seek up to $8,500 in reimbursement for documented monetary losses, alongside two years of comprehensive credit and identity theft protection.

The Cost of Compromised Data

The lawsuit alleged that Columbia University failed to implement adequate protections for its sensitive data, leaving millions open to fraud and identity theft. While the university denied any wrongdoing, it opted to settle to avoid the mounting costs and unpredictability of prolonged litigation.

For those who suffered actual financial harm, the settlement provides a path to recovery. Claimants can submit documentation for losses occurring on or after May 16, 2025, provided those losses are tied to the specific types of information exposed in the breach. If a victim cannot prove a specific monetary loss, they are still eligible for an alternative cash payment, though the exact amount will depend on the total number of valid claims and the remaining funds after legal and administrative fees are deducted.

The financial breakdown of the $16.13 million fund reveals the heavy toll of class action administration. Attorneys’ fees alone could reach up to $4,031,250, while class representatives will receive service awards of $500 each. The remaining balance will be split between credit monitoring costs and payments to the millions of affected individuals.

Cost of a data breach report from ibm security note measured in usd

Who Can Actually Claim the Money?

To be eligible, you must be a U.S. resident whose information was compromised in the May 2025 attack and who received an official notice from Columbia University. Without a unique notice ID number and a confirmation code, a claim cannot be submitted.

The process for claiming benefits is streamlined through digital and physical channels:

Documentation-Based Claims: Requires receipts or statements showing losses from identity theft or fraud. These must be non-self-prepared documents.
Cash & Credit Monitoring: Requires only the valid notice ID and confirmation code.
Payout Methods: Payments can be issued via Zelle, PayPal, Venmo, or a physical check.

All class members can claim two years of three-bureau credit monitoring, dark web monitoring, and identity theft insurance covering up to $1,000,000, including fully managed recovery services.

The Calendar for Recovery

The window to opt out of the settlement closes on December 22, 2026. For those seeking payment, the hard deadline to file a claim is January 21, 2027.

The final approval hearing is scheduled for February 23, 2027. However, don’t expect a check in the mail immediately after that date. The settlement administrator will only issue payments once the court resolves any potential appeals and grants final approval.

Some may argue that a $16.1 million fund is a drop in the bucket when spread across nearly 3 million people.

Columbia University Settlement Claim Requirements and Mailing Address

What happens if I never received a notice from Columbia University?
According to the settlement terms, individuals who did not receive a notice are not eligible to file a claim, as the class is closed and requires a specific notice ID and confirmation code.

Can I claim money if my bank already reimbursed me for the fraud?
No. The settlement explicitly states that class members cannot claim losses that a third party has already reimbursed.

Where do I mail a physical claim form?
Forms should be sent to the Columbia University Data Settlement Administrator, 1650 Arch St., Suite 2210, Philadelphia, PA 19103.