People notified of Columbia University’s May 2025 cyberattack have until Jan. 21, 2027, to file a claim in a $16,125,000 class action settlement, either for up to $8,500 in documented losses or a cash share of what is left in the fund. The class covers U.S. residents whose private information was compromised and who were sent notice of the attack, and Columbia estimates 2,973,631 people are in it. The university denies wrongdoing.
The case is In re Columbia University Data Breach Litigation, No. 1:25-cv-05541, in the U.S. District Court for the Southern District of New York. Judge P. Kevin Castel will hold the final approval hearing Feb. 23, 2027, at 2 p.m. Eastern in Courtroom 11D at 500 Pearl Street in Manhattan, and no payment goes out before the court approves the deal and it becomes final.
Two ways to be paid, and only one needs receipts
The first route reimburses documented losses of up to $8,500. The losses must have started on or after May 16, 2025, and must trace to the kind of information that was exposed: unreimbursed costs from identity theft or fraud, falsified tax returns, other misuse of personal data, small related costs such as notary fees, postage, copying and mileage, and credit monitoring bought since that date.
Proof is strict. The claim form asks for a bank or credit card statement or another record of each charge, and claimants may black out unrelated transactions and all but the last four digits of account numbers. Documents a claimant prepared alone are not enough, and the proof has to support the exact amount requested.
The second route is an alternative cash payment, which needs no receipts but comes with no promised figure. It is whatever remains of the fund after attorneys’ fees, expenses, service awards, administration costs, the cost of the credit monitoring and every approved documented-loss claim. A claimant picks one route or the other, not both, and payments can be cut back proportionally if claims run high.
Anyone who received a Columbia notice by email or mail has one job before Jan. 21: use the Notice ID printed on it to file at the settlement website or mail a paper form postmarked by that date, and decide whether the receipts justify the loss route. The notice says filing a claim is the only way to receive benefits, and a claim also gives up the right to sue Columbia separately over the breach.
Stay ahead of settlement and refund news: Miss an enrollment or claim deadline and the money can be gone. Join the Retirement Money Brief and we’ll send you our Open Settlements & Refund Tracker as a welcome gift.
Get the Brief + the settlements tracker →
We may earn a commission from links on this page.
What was exposed, and why the Notice ID is the gate
According to the allegations summarized in the notice, the attackers reached full names, dates of birth, addresses, Social Security numbers, driver’s license numbers and financial account information, including card, bank account and routing numbers. The files also held medical and health insurance details, academic records, financial aid information and tuition data. That breadth is why the documented-loss list reaches past stolen money to fraudulent tax returns.
Benefits require a unique Notice ID, and claims from people outside the class are rejected. Anyone who misplaced the notice can reach the settlement administrator at 1-833-617-4373 or at 1650 Arch Street, Suite 2210, in Philadelphia, rather than guess at a number.
Two years of three-bureau credit monitoring, dark web monitoring, identity theft insurance up to $1,000,000 and managed identity recovery come on top of either payment route. The claim form treats it as a separate checkbox, so a claimant can take the monitoring and the cash together. Payment can arrive by PayPal, Venmo, Zelle or a mailed check.
Fees, the February hearing and the dates that come first
Two dates fall before the claim cutoff. Anyone who wants out of the settlement, or wants to object to it, has until Dec. 22, 2026, with the request postmarked by then. The claim deadline of Jan. 21, 2027, applies to online filings and to paper forms alike.
Class counsel will ask the court for up to 25 percent of the fund, or $4,031,250, plus expenses, and the long-form notice says the judge can award less. Service awards of $500 are requested for each class representative. Taking the full fee request out of $16,125,000 leaves about $12.1 million before expenses, administration and credit monitoring come off.
The notice gives no payment date and says it may take time. Columbia says it has added defensive tools and increased monitoring, and the agreement commits it to keep those security measures in place for three years after the settlement takes effect.
Locking the file while the claim waits
Settlement monitoring watches for misuse after the fact. A credit freeze is what stops a new account from being opened, and the FTC says freezes are free to place and lift at each of the three bureaus, Experian, TransUnion and Equifax. A free one-year fraud alert can be added with a call to one bureau, which must notify the other two.
People who find a fraudulent account can report it at IdentityTheft.gov, where the FTC builds a free recovery plan and pre-filled letters to the credit bureaus, businesses and debt collectors. Those letters, a bank’s fraud notice and an IRS rejection letter are the kind of third-party paper the $8,500 route asks for, so they belong in a folder from the first day.
With nearly 3 million people in the class and Social Security numbers among the data, the size of the cash share depends on how many file, and the notice offers no estimate. The documented-loss route is the only one with a known ceiling, which makes the paper trail the real asset for anyone who has already been hit.
Holding a Columbia breach notice with a Notice ID on it?
The Columbia claim has two moving parts that trip people up: a Notice ID that the form will not work without, and statements that must back every dollar of an $8,500 request. The Jan. 21, 2027, cutoff applies whether the claim is filed online or mailed.
The Money Owed to You Bundle collects eight guides, including Open Settlements: How to File: the four-date rule, the two claim tiers, proof without receipts, and chasing a payment. That is the step-by-step for choosing between a documented-loss tier and a flat cash tier, and for following up after the form is in.
Inside is a Claim It Checklist with a 20-minute sweep to repeat twice a year, a filing checklist and a scam stop-list, and every guide comes in a large-print edition.
Get the filing checklist and proof-without-receipts guide for open settlements →
This article was produced with AI assistance and edited for accuracy against the sources linked above.
